Sandboxing pour Agents IA — du conteneur Docker à la MicroVM Firecracker

Your AI agent runs code, spawns shells, hits the network. How do you isolate what it shouldn't do? A tour of isolation boundaries: Docker, gVisor, Firecracker MicroVMs.