•
Running machine-generated code inside runc means any container escape compromises the host kernel. By routing execution through gVisor's user-space Sentry, we can sandbox arbitrary agent workflows without breaking build tools. A technical breakdown of the runtime flags, filesystem memory overlays, and why SYS_ADMIN in user-space Go shifts the security boundary in your favor.
Compute isolation protects the host kernel, but an LLM agent with uncontrolled outbound access still exposes your cloud metadata, peer containers, and VPC to SSRF attacks. When standard Docker network hot-plugging fails inside gVisor, how do you prevent egress leaks before code executes? Here is the architecture and Go implementation of an egress gate that closes by default and releases access in a single atomic transaction.
My agent framework runs untrusted, LLM-generated scripts. I compare seven isolation options, from a bare process to a full VM, against my threat model and explain why I chose gVisor and which trade-offs I accept.
