Sandboxing

Where agent isolation should live: the workstation, the cluster, the wrapper, the framework, or the provisioning layer.

Agent Sandbox - the Kubernetes SIG Apps CRD for declarative sandbox fleets, delegating isolation to gVisor or Kata.
aigate - the fourteen-star kernel-enforced wrapper, kept as the reference design for small-scale OS-level agent sandboxing.
ArtifactFS - Cloudflare’s FUSE driver that mounts big repos in seconds, the provisioning layer sandboxes need before isolation matters.
Clawk - the disposable-VM workstation tool, the agent gets its own Linux machine instead of yours, pre-1.0 on macOS.
CubeSandbox - Tencent’s E2B-compatible RustVMM/KVM microVM sandbox, sub-60ms boots, its traction built on launch announcements rather than community discussion.
Flue - the Astro team’s agent framework whose contribution is a three-tier sandbox taxonomy and durable execution.
OpenSandbox - the Apache-2.0 general sandbox platform (SDKs, CLI, MCP, K8s runtimes) that grew on GitHub trend charts, not Hacker News.
OpenShell - NVIDIA’s container-and-MicroVM runtime where declarative policy and inference-proxy keys make the boundary credible.

Its members are compared on shared rows in the Sandboxing Feature Matrix.

Changes
#