Kata Containers
An open-source container runtime project that provides hardware-level isolation by running containers inside lightweight virtual machines. Each container or Pod runs in an independent micro-VM with its own dedicated kernel.
Core Facts
Timeline (last 90 days)
Runtime sandboxes use technologies such as gVisor, Kata Containers, and Firecracker microVMs to confine Agent-executed code in an isolated environment, so that even if exploited by a prompt injection attack, it is difficult to move laterally or steal host data.
The common trend among gVisor, Firecracker, and Kata Containers is the fusion of VM-level security boundaries with container-level lightweight experience.
Codex runs by default in a sandbox on the local machine, commands requiring additional permissions will prompt the user, and it can also optionally run in a cloud-hosted kata container VM with output streamed back to local.
Kata containers launch an independent micro-VM kernel for each workload, providing kernel-level isolation with an attack surface significantly smaller than ordinary containers isolated only by cgroups and namespaces.
Agent执行沙箱主流实现分为进程级隔离（seccomp、namespace）、容器级隔离（Docker、gVisor）、虚拟机级隔离（Firecracker、Kata Containers）三个层次
Kata Containers combines the hardware isolation of lightweight virtual machines with the ease of use of the OCI container standard.
All Facts (6)
Kata Containers combines the hardware isolation of lightweight virtual machines with the ease of use of the OCI container standard.
65%UnverifiedRuntime sandboxes use technologies such as gVisor, Kata Containers, and Firecracker microVMs to confine Agent-executed code in an isolated environment, so that even if exploited by a prompt injection attack, it is difficult to move laterally or steal host data.
50%UnverifiedThe common trend among gVisor, Firecracker, and Kata Containers is the fusion of VM-level security boundaries with container-level lightweight experience.
50%UnverifiedCodex runs by default in a sandbox on the local machine, commands requiring additional permissions will prompt the user, and it can also optionally run in a cloud-hosted kata container VM with output streamed back to local.
50%UnverifiedKata containers launch an independent micro-VM kernel for each workload, providing kernel-level isolation with an attack surface significantly smaller than ordinary containers isolated only by cgroups and namespaces.
50%UnverifiedAgent执行沙箱主流实现分为进程级隔离（seccomp、namespace）、容器级隔离（Docker、gVisor）、虚拟机级隔离（Firecracker、Kata Containers）三个层次
50%