AI Agent Sandboxing Consensus Crystallizes: gVisor for Most Workloads (~10-30% I/O Overhead), Firecracker MicroVMs for Untrusted Code (125ms Boot, <5MiB RAM), Docker Alone Insufficient

Docker Blog·medium signal

Multiple production guides converge on the same recommendation hierarchy for AI agent code execution: Docker containers share the host kernel and can't safely contain untrusted AI-generated code; gVisor intercepts syscalls in user-space without full VMs (used by Google Agent Sandbox on GKE and Modal); Firecracker gives each execution a dedicated kernel via KVM with 125ms boot time and under 5MiB overhead per microVM. Docker has responded with its own MicroVM-based Sandbox product. The key insight: if your agent generates and executes code, standard containers are not sufficient isolation.