Isolation Mechanisms: VMs, Containers, Namespaces, Oh my

[sarocu]

Abstract

There's a ton of isolation mechanisms out there (e.g. for agent operations), each with advantages and disadvantages. Let's review the basic levels of isolation and good applications for each:

• Basic Linux namespacing, cgroups, etc
• Node isolates
• Common isolation methods for different agent harnesses
• Container runtimes
• Virtual machines & KVM
• Use cases and tradeoffs
• Isolation within application architecture

I was previously the head of infrastructure at Flatfile and Obvious.ai and now am CEO at Heyo Computer. Have run workloads at scale on various technologies including Kubernetes/containers, VMs, Node isolates (and predecessors) lambdas, and sandboxes (e.g. E2B).

Date

7/1/2026

This will be my first tech talk

• This will be my first tech talk

Code of Conduct

• I agree to follow this project's Code of Conduct

[eitanfire]

Thanks for submitting this. I think this could be a strong fit for a future BoulderJS feature slot. I’ve reached out directly as well to check on interest and availability.