The isolation tech behind managed AI sandboxes (gVisor, Firecracker) — worth it locally?

In Part 1, I laid out three options for where to draw the isolation boundary around an AI coding agent: Claude Code Sandbox, Docker AI Sandboxes, and AI Sandbox + HostMCP (this project). All three run on a normal dev machine with nothing more exotic than Docker or OS-level primitives.

But if you look at how managed cloud AI agent services isolate their sandboxes, a different pair of names comes up: gVisor and Firecracker. They're worth understanding on their own terms — and worth asking whether they belong in a local setup too.

Isolation technology proper: gVisor and Firecracker

Managed cloud AI agent services that need strong isolation actually use technologies like these:

AWS Bedrock AgentCore Code Interpreter: a "one-session-one-microVM" model, spinning up a dedicated Firecracker microVM per session (AWS docs)