Workload sandboxing, hypervisor isolation, microkernels, unikernels. Running untrusted intelligence safely.