Secure Isolation Primitives

A new approach captures only filesystem and process changes between agent steps.

Cgroups v2's unified hierarchy makes resource limits on sandboxed processes actually enforceable.

Kernel-enforced syscall filtering prevents processes from accessing system calls they don't need.

Mandatory access control in the kernel stops AI agents from escaping their sandbox permissions.

Each namespace controls one resource, leaving five others for other layers to defend.

Linux sandboxes need capability dropping to block privilege escalation through child processes.

Isolating untrusted AI agents requires choosing whether workloads share the host kernel.

eBPF monitors what AI agents actually do at the kernel level, where approval logic cannot reach.

Linux kernel isolation mechanisms protect AI agents from becoming a path to host compromise.

Confusing zero trust and least privilege leaves AI agent sandboxes dangerously under-enforced.

Linux defers memory copying until processes actually write, enabling instant VM clones.