Real Linux. Hard boundary.
Every sandbox is a Firecracker microVM with its own kernel boundary, disks and network identity. CPU, memory, storage and network rate are enforced by the host.
- Isolation
- Firecracker + Jailer
- Images
- Curated and digest-pinned
- Shape
- Preset or explicit resources

