Application kernel

A user-space kernel (e.g. gVisor-style) that intercepts and re-implements a guest workload's syscalls so an untrusted process is isolated from the host kernel without paying for a full VM.

grounded in: Latest-trends themes 'AI coding agents are a security liability' and 'Sandboxing/isolation for AI agents' — the community answer of disposable, contained execution environments (Clawk giving coding ag