gVisor is a security option for building AI agents. Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM.
Worth knowing. Fast to start, but 10-30% overhead on I/O-heavy work. Good for compute-bound agent code; reach for a microVM if the threat model is serious.
# runsc — see https://gvisor.dev/docs/user_guide/install/
| Option | What it does | Licence | Self-host |
|---|---|---|---|
| gVisor | Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. | Open source | Yes |
| Firecracker | AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. | Open source | Yes |
| Kata Containers | MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. | Open source | Yes |
| No isolation (host process) | The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. | Open source | Yes |
| E2B | Firecracker sandboxes for running code the agent wrote, safely. | Open source | Yes |
| Llama Guard | Open-weight classifier for input and output safety. Runs wherever you run it. | Open source | Yes |
| Guardrails AI | Declarative input/output validators with a hub of prebuilt checks. | Open source | Yes |
| NeMo Guardrails | NVIDIA's programmable rails — constrain topic, dialogue path and tool use. | Open source | Yes |
| Lakera Guard | Prompt-injection and jailbreak detection as a low-latency API call. | Proprietary | No |
| Rebuff | Open-source prompt-injection detector with canary tokens. | Open source | Yes |
| Invariant | Policy engine and analyzer for agent traces and MCP tool calls. | Open source | Yes |
| Descope Agentic Identity | Identity, delegated consent and scoped tokens for agents acting on behalf of users. | Proprietary | No |
| Auth0 for AI Agents | Token vault, async user approval and fine-grained authorization for tool calls. | Proprietary | No |
| Oso | Authorization-as-a-service — decide what this agent may touch, per record. | Open source | Yes |
| Microsoft Presidio | PII detection and redaction before text ever reaches a model provider. | Open source | Yes |
| Cloudflare AI Gateway | Rate limiting, caching, spend caps and logging in front of any provider. | Proprietary | No |
| iron-proxy | Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. | Open source | Yes |
Every page here answers to Accept: text/markdown and returns the same content at roughly a tenth the tokens. No separate site, no toggle — same URL.
curl -s -H "Accept: text/markdown" https://newagent.build/c/gvisor