Topic

OS-level isolation

Confinement assembled from operating-system primitives such as macOS Seatbelt profiles, Linux namespaces, bind mounts and seccomp filters, as an alternative to virtual machines or container runtimes.

Current clusters

build1 publisher

solon-ai-sandbox puts an agent's bash call inside seatbelt or bwrap without a container

The Solon AI module ports Claude Code's sandbox-runtime to Java, denying writes by default and protecting reads only where the operator names a path. Keeping that deny list current is the standing cost.

Publishers:dev.to

Reality

Evidence58
Adoption12
Hype gap+12
Incentives60
Confidence55