Kern

Kern is a sandbox and resource runtime for code you do not necessarily trust, including the code an agent just wrote. It takes an OCI image and gives you a kernel-enforced container in a few milliseconds, with no daemon and no root, from a binary of about a megabyte and a half.