Sandbox runtime

A sandbox runtime is a single isolated environment in execution: a microVM or hardened container with a root filesystem, a network interface, and resource limits.

A sandbox runtime is a single sandbox in execution. The runtime is a microVM or a hardened container with a root filesystem, a network interface, and resource limits. Every part of the runtime is configured on the assumption that the code inside is hostile. The isolation mechanism comes from the virtualization layer, and the isolation boundary describes the choices at that layer.