Kata Containers

kern is a fast, rootless OCI container runtime, sandbox, and virtual resource runtime distributed as a small static binary without a daemon. It creates kernel-enforced containers from OCI images, using user, PID, mount, network, UTS, and IPC namespaces, overlay or read-only roots, a deny-by-default seccomp allowlist, and cgroup v2 limits; the `--security-profile untrusted` option applies the documented hardened bundle. It can also attach named CPU, memory, disk, and device profiles from `kern.toml` to containers, or apply resource caps directly to host processes with optional Landlock write confinement. The project supports container operations, Dockerfile builds, image pull/push and save/load, stack execution through its own or Docker Compose format, and includes Python and Node SDKs plus an MCP server for agents. Its Rust dependency tree uses libc, while image pulling delegates to system `curl` and `tar`; it runs natively on Linux, requires WSL2 on Windows, and needs a Linux virtual machine on macOS.

Kubernetes (K8s) is an open-source container orchestration system hosted by the Cloud Native Computing Foundation. It manages containerized applications across multiple hosts, providing mechanisms for deploying, maintaining, scaling, and scheduling workloads. Applications can be configured with YAML and deployed across hybrid-cloud environments; the platform is also used for production operations involving storage, databases, networking, and security hardening.

gVisor is an application kernel and container sandbox developed by Google that provides an isolation layer between containerized applications and the host operating system. Written in Go and running in user space, it implements a Linux-like interface while limiting the host-kernel surface available to applications. Its Open Container Initiative runtime, runsc, integrates with Docker and Kubernetes to run sandboxed containers, using a third approach distinct from syscall filters, wrappers around Linux isolation primitives, and conventional virtual machines.

Docker Sandboxes is a Docker-developed proprietary tool for running AI coding agents and other workloads inside isolated microVMs on a local machine or Docker-managed cloud infrastructure. Each sandbox has its own kernel and filesystem, controls access to the host filesystem, network, and tools, provides a private Docker daemon for test containers, uses secret placeholders, blocks network access by default, and records an audit trail. It supports agents including Claude Code, Codex, Gemini CLI, and OpenCode, with configurable network and filesystem rules, read-only mounts, MCP catalogs, and policy-based governance controls. It is distributed as the `sbx` command-line tool for macOS, Windows, and Linux, with stable, release-candidate, and nightly builds.

KADATH (Kernel for Agentic Darwinian Adaptation, Tooling, and Heredity) is an evolutionary multi-agent runtime developed by i3t4an. It evolves populations of complete agents across reproducible epochs: an Architect turns a goal into a measurable benchmark, organisms attempt the goal, an independent Grader scores their evidence, and selection, mutation, reproduction, and replacement produce later generations. Each evolvable genome includes an agent's system prompt, Python implementation, tools, dependency declarations, and supporting files, rather than only a prompt or response. The kernel keeps the objective, benchmark, scoring, scheduler, lineage, database, deadlines, containers, and isolation rules outside the genome; agents can change only during the post-grade mutation phase. The interactive runtime asks for an OpenAI API key and model ID, then collects the goal, epoch duration, population size, and epoch count. Its local runtime prepares Docker-based PostgreSQL, MinIO, LiteLLM, and SearXNG services.