How it works
The sandbox runs as a container. Each system call the code makes goes to the user-space kernel and not to the host. The user-space kernel does the work itself and passes only a small set of calls to the host.
When providers choose it
A user-space kernel needs no hardware virtualization and adds little memory to each sandbox. gVisor is the common one.
User-space kernel technologies
gVisor
An application kernel from Google. Used by Agent37 Cloud, Bunny Sandbox, Cua Fleets, Modal and Sandbox0.
