Flashcards

A kernel framework of hook points at every security-relevant decision, where a pluggable module answers allow or deny.

A Linux facility that filters which syscalls a process may make, expressed as a BPF (Berkeley Packet Filter) program over the syscall number and scalar arguments.

The first unprivileged, self-imposed Linux Security Module (LSM): a process sandboxes itself with access rules over real kernel objects.

The kernel feature that gives a process a private view of a global resource, mounts, PIDs, network, users, the building block of containers.

The kernel mechanism that meters and limits a group of processes' CPU, memory, I/O, and PIDs.

The kernel's split of root's monolithic power into ~40 discrete privileges that can be granted or dropped individually.

The union filesystem container engines use by default for images: read-only layers stacked under one writable layer, with copy-on-write.

A path-based Linux Security Module where an administrator writes per-application profiles enforced system-wide.

A label-based Linux Security Module enforcing a comprehensive, system-wide mandatory access policy.

macOS's built-in process sandbox, driven by SBPL profiles via sandbox-exec / sandbox_init.

An unprivileged sandboxing tool that confines a process by building it a private mount-namespace filesystem view.

Anthropic's standalone process-sandbox library, Seatbelt on macOS, bubblewrap + seccomp on Linux, behind one interface with an egress proxy.

A cross-platform agent sandbox using Landlock + seccomp on Linux and Seatbelt on macOS, with an L7 credential-injecting egress proxy.

The ubiquitous container runtime, namespaces + cgroups + a default seccomp/AppArmor profile, that shares the host kernel.

A daemonless, rootless-friendly container engine, drop-in compatible with Docker's CLI.

The core container runtime that manages the container lifecycle beneath Docker and Kubernetes.

The standard OCI runtime: the low-level executor that assembles namespaces, cgroups, and seccomp into a running container.

A fast, low-memory OCI runtime written in C, the default executor under Podman.

A system-container and VM manager (LXC/LXD lineage) with one CLI for both, the low-friction Linux isolation choice.

Google's userspace kernel that intercepts a container's syscalls, shrinking host-kernel attack surface without a VM.

A container runtime giving user-namespace isolation and Docker-in-Docker without --privileged, hardened, still shared-kernel.

The Linux kernel's built-in hypervisor, turning the kernel into a type-1 hypervisor using CPU virtualization extensions.

Apple's low-level hypervisor API, the macOS equivalent of KVM, exposing hardware virtualization to userspace VMMs.

Microsoft's hypervisor API exposing Hyper-V's hardware virtualization to third-party userspace VMMs, the Windows KVM analog.

Apple's high-level VM API on top of Hypervisor.framework, the modern way to run Linux VMs on Apple Silicon.

AWS's minimal virtual machine monitor that boots a microVM with its own kernel in ~125ms, built for running untrusted multi-tenant code.

A Rust VMM on KVM, more featureful than Firecracker, that confines itself with Landlock as its second wall.

The veteran, feature-complete machine emulator and VMM, full device model, full cross-architecture emulation.

An embeddable, in-process VMM exposed as a C library, the microVM engine under krunvm, Podman+krun, smolvm, and microsandbox.

Cognition's homegrown microVM hypervisor behind Devin, paired with a blockdiff snapshot format for fast fork/rollback.

An OCI/Kubernetes runtime that transparently runs each container inside its own lightweight VM (Firecracker/Cloud Hypervisor/QEMU).

A CLI that creates and runs microVMs from OCI images using libkrun.

Podman with the krun runtime, run an OCI container as a microVM with the familiar podman CLI.

A cross-platform CLI that runs OCI images as libkrun microVMs with secure defaults, network off, mounts opt-in, packable into portable .smolmachine files.

A self-hostable microVM sandbox that boots OCI images in ~100ms via libkrun, with a careful filesystem-passthrough and egress model.

Apple's first-party tool that runs each OCI container inside its own lightweight VM on Virtualization.framework.

Canonical's tool for spinning up Ubuntu VMs with a single command, on KVM (Linux) or HVF (macOS).

Linux VMs on macOS with automatic file sharing and port forwarding, the engine under Colima.

A macOS container runtime that boots a Docker/containerd host inside a Lima Linux VM, a free Docker Desktop alternative.

A fast, proprietary macOS app for running Docker containers and Linux machines on Virtualization.framework.

A GUI VM app for macOS, running guests on Virtualization.framework (fast) or QEMU (any architecture).

A CI-focused macOS/Linux VM tool on Virtualization.framework, with OCI-registry distribution of VM images.

A self-hosted microVM sandbox for agent code execution on Cloud Hypervisor, notable for snapshot-and-backtrack and for a badly stale engine pin.

A sandbox platform that runs code in Firecracker microVMs, with per-sandbox network isolation, self-hostable or hosted.

A serverless compute platform that isolates workloads with gVisor, stronger than runc, weaker than a hardware VM.

A dev-environment sandbox platform whose self-hosted default was measured as a privileged runc container, despite 'dedicated kernel' marketing.

A cloud platform that gives AI agents full Linux VMs, provisioned in under a second with live forking and pause/resume.

A Docker container as your whole dev environment, real reproducibility and process separation, but a convenience boundary, not a hard one.

A dev container inside a dedicated per-codespace VM, the real VM boundary that local dev containers lack.

The only major coding-agent CLI that is sandboxed by default: workspace-write, network off.

Has a real native sandbox, but it is opt-in, the default posture runs with your full privileges behind approval prompts.

Sandbox is off by default; on Linux the only isolation option is a container (Docker/Podman), not native syscall confinement.

A Gemini CLI fork with the same posture: sandbox off by default, container-only isolation on Linux.

No OS-level isolation at all, it runs with your full privileges, gated only by approval prompts.

No OS-level isolation, it runs with your full privileges, gated only by approval prompts.

No OS-level isolation, it runs with your full privileges, gated only by approval prompts.

The local IDE outlier: an OS sandbox is on by default for its terminal/fetch tools.

Runs commands with full privileges plus a best-effort sandbox the vendor explicitly calls 'not a security boundary'.

Runs local commands with your full privileges, gated only by approval prompts; strong isolation is a separate cloud product.

Runs local commands with your full privileges, gated only by approval prompts; no local OS sandbox.

Runs local commands with your full privileges, gated only by approval prompts and prefix allow/deny lists.

Runs local commands with your full privileges, gated only by approval prompts and permission lists.

Local, full privileges by default ('same access as you'); an opt-in preview sandbox and a --cloud mode exist.

Runs local commands with your full privileges, gated only by approval prompts; no built-in sandbox.

The async PR bot runs in an ephemeral GitHub Actions VM with the best-documented default-on egress firewall of any tool here.

The best-documented closed agent and the only one that names its primitive: a homegrown otterlink microVM.

Runs a fresh GCP VM per task, but the underlying isolation technology is undisclosed.

Mid-migration from hardened seccomp-bpf containers to microVMs; a given user may be on either backend today.

Open-source: each session runs in a Docker container by default (host network off).

Open-source: a container per task (via SWE-ReX), built for massively parallel runs.

Asserts cloud sandboxing but does not disclose the isolation technology; its local droid exec CLI has no OS isolation.

Runs in an ephemeral cloud workspace, but the isolation technology is undisclosed.

Runs hundreds of ephemeral cloud sandboxes in parallel, but the isolation technology is undisclosed.