The threat-model-first sandbox guide is the reference to bookmark.

Because agent code is generated at runtime and can't be reviewed before it runs, the 2026 model treats it as arbitrary adversarial code and picks one of three primitives by threat model: Firecracker microVMs for regulated data, gVisor for compute-heavy multi-tenant, V8 isolates for latency-critical JS (Northflank). Defense-in-depth reportedly cuts incidents ~90% versus unrestricted host access. Pick by data sensitivity, not by whatever container you already have.