gVisor

Kata Containers is an open-source container runtime and project that runs workloads inside lightweight virtual machines, combining a container-like interface with the workload isolation and security properties of virtual machines. Its core runtime integrates with container managers through a containerd shim v2 implementation; an agent inside each virtual machine or pod sets up the container environment, while a hypervisor provides the virtualized boundary. The project supports multiple virtualization technologies and architectures, uses a configuration file covering the runtime, agent, and hypervisor, and includes a host-capability check through the `kata-runtime check` command. The code is licensed under Apache 2.0.

Docker Sandboxes is a Docker-developed proprietary tool for running AI coding agents and other workloads inside isolated microVMs on a local machine or Docker-managed cloud infrastructure. Each sandbox has its own kernel and filesystem, controls access to the host filesystem, network, and tools, provides a private Docker daemon for test containers, uses secret placeholders, blocks network access by default, and records an audit trail. It supports agents including Claude Code, Codex, Gemini CLI, and OpenCode, with configurable network and filesystem rules, read-only mounts, MCP catalogs, and policy-based governance controls. It is distributed as the `sbx` command-line tool for macOS, Windows, and Linux, with stable, release-candidate, and nightly builds.

kern is a fast, rootless OCI container runtime, sandbox, and virtual resource runtime distributed as a small static binary without a daemon. It creates kernel-enforced containers from OCI images, using user, PID, mount, network, UTS, and IPC namespaces, overlay or read-only roots, a deny-by-default seccomp allowlist, and cgroup v2 limits; the `--security-profile untrusted` option applies the documented hardened bundle. It can also attach named CPU, memory, disk, and device profiles from `kern.toml` to containers, or apply resource caps directly to host processes with optional Landlock write confinement. The project supports container operations, Dockerfile builds, image pull/push and save/load, stack execution through its own or Docker Compose format, and includes Python and Node SDKs plus an MCP server for agents. Its Rust dependency tree uses libc, while image pulling delegates to system `curl` and `tar`; it runs natively on Linux, requires WSL2 on Windows, and needs a Linux virtual machine on macOS.

Microsandbox is a local-first microVM runtime and library for running untrusted workloads, including AI-agent tasks, user code, plugins, CI jobs, development environments, scrapers, and automation. It uses hardware-level isolation and runs standard OCI container images from registries such as Docker Hub and GHCR, with Docker-like image, command, shell, and volume workflows. The project provides SDKs for TypeScript, Rust, Python, Go, and Ruby, along with a CLI for booting and controlling sandboxes. Applications can create microVMs as child processes without a setup server or long-running daemon; sandboxes can also run detached for long-lived sessions. Agent Skills and an MCP server support agent-created sandboxes, and the project documents secret handling intended to keep keys out of the VM. It runs on Linux, macOS, and Windows, with platform-specific virtualization requirements, and is described as beta software.

VirtualApp (VA) is an Android sandbox and virtualization SDK that runs applications inside an isolated internal space without installing them into the Android system. It is intended for integrating into host applications and supports use cases such as app cloning, multiple app instances, internal APK installation, app control, and plugin development. Its framework proxies requests between virtual applications and the Android framework, rewriting installation-related and other app parameters so the system treats the requests as belonging to the host. A native layer redirects file I/O to the virtual installation path and hooks functions that cannot be handled at the framework layer. The runtime includes host, plugin, virtual-app client, VA Server, and child processes; separate main and plugin packages support 32-bit and 64-bit applications. The SDK also provides Java and native hook capabilities, file and component isolation, and APIs for starting the engine, installing a package for a user, and launching an app. The repository states that its public code stopped updating in December 2017 and directs users needing the continuously updated business edition to obtain a commercial license. It describes support for Android 5.0 through 17.0, ARM 32-bit and 64-bit processors, and 32-bit and 64-bit applications.