Engineering notes from the team building an open-source agent runtime — sandbox design, LXC and Incus internals, container isolation, eBPF network policy, and honest comparisons of the tools in this space. We write up what actually broke, not just what shipped.
"Untrusted" is three different threats, and most teams defend the wrong one — shopping for isolation technology while running with unrestricted outbound network access. What a container boundary actually buys you, what it doesn't, and the case where our own product is the wrong tool.
Everyone uses a coding agent to write code; almost nobody talks about how to scale one up. Two things made it work for us — a software quality process the agents actually follow, and one isolated Linux box per agent. Nobody contaminates anybody, and nothing blows up your laptop.
Containarium, E2B, Modal, and Daytona side by side on the things that actually decide the choice: self-hosting, persistence, isolation technology, license, MCP support, and cost. Written by a vendor in the space, so it says plainly where each competitor wins.
More posts are on the way — LXC versus microVMs for agent workloads, and what we found taking a debugger to a liblxc deadlock in production. Subscribe by RSS to get them.
Self-host the open source on your VM, or start free on the hosted cloud.