Isolation boundary

An isolation boundary is the mechanism that separates a workload from the host and from its neighbors, and in a sandbox it has to hold against a workload actively trying to escape.

In a sandbox the code is assumed to be untrusted, so isolation is the primary feature. The isolation boundary has to hold against a workload that actively tries to escape. Three approaches provide the boundary, and each approach trades isolation strength against speed and density.