Running untrusted code so that it cannot reach anything it was not given. The 2026 stack has three tiers, and the differences are load-bearing rather than cosmetic:
- microVMs (Firecracker, Cloud Hypervisor) give each workload its own kernel on KVM, booting in roughly 100-200ms. Strongest isolation short of separate hardware.
- User-space kernels (gVisor) intercept syscalls and proxy them, avoiding a full VM at the cost of a large syscall-compatibility surface.
- Shared-kernel containers — the default, and the weakest: one kernel bug is a cross-tenant breach.
Kata Containers is the orchestration layer that makes microVMs behave like containers under Kubernetes, and since 3.x it carries confidential-container support (Intel TDX, AMD SEV-SNP) so the host operator cannot read guest memory. NVIDIA’s GPU Operator integrates it directly, single-GPU passthrough only.
Why this is now a market: AI agents write and execute code, so somebody must run untrusted code as a product. E2B ($35M, per-run Firecracker kernels) and Daytona ($24M Series A, shared-kernel containers, went closed-source in Jun 2026 citing security) monetise it as a developer SDK, with Modal and Fly Machines pressing from the platform side. The 2026 read is that the sandbox is the most contested slot in the agent stack. See.
Related
- Hypervisor Isolation — the same property sold to infrastructure operators rather than developers
- Unikernel — has this property natively but sells on efficiency
- GPU Virtualization — the frontier: sandboxes are CPU-first today