https://containarium.dev/blog/ Engineering notes on agent sandboxes, LXC internals, and container isolation from the team building Containarium. en © FootprintAI. Apache 2.0 for OSS components. Mon, 31 Aug 2026 12:00:00 +0000 https://containarium.dev/og.png https://containarium.dev/blog/ https://containarium.dev/blog/ownership-not-operations https://containarium.dev/blog/ownership-not-operations Mon, 31 Aug 2026 12:00:00 +0000 Custody doesn't mean doing it all yourself. Owning something and running it are two different jobs, and only one has to be yours: hiring people to run your machines or scan your cloud is normal, and the teams caught by this leak had outsourced ownership along with the work. The four things you never hand over, the four tests of a healthy arrangement, and how a company with no IT staff moves onto its own cloud account. Also available in Traditional Chinese: https://containarium.dev/zh-tw/blog/ownership-not-operations https://containarium.dev/blog/custody-not-trust https://containarium.dev/blog/custody-not-trust Sun, 30 Aug 2026 12:00:00 +0000 Day two of the PaaS credential leak: the official statement says only environment variables were exported; the rumors say far more. You can verify neither — and that verification gap is what you signed up for when you handed over custody. On trust vs. verify vs. custody, and the four rules of real BYOC. Also available in Traditional Chinese: https://containarium.dev/zh-tw/blog/custody-not-trust https://containarium.dev/blog/secret-store-blast-radius https://containarium.dev/blog/secret-store-blast-radius Sat, 29 Aug 2026 12:00:00 +0000 A PaaS platform leaked tenant environment variables — API keys in the open. The leak path in these incidents isn't lateral movement between clusters; it's one secret store scraped for every tenant at once. What to do in the first hour, why firewalls can't stop it, and the seven rules of a security boundary we build by. Also available in Traditional Chinese: https://containarium.dev/zh-tw/blog/secret-store-blast-radius https://containarium.dev/blog/agent-sandbox-density-benchmark https://containarium.dev/blog/agent-sandbox-density-benchmark Wed, 26 Aug 2026 12:00:00 +0000 Containarium scored half of upstream agent-sandbox's density on Kubernetes — 186 vs. 373. We root-caused it to a real CLI gap, shipped the fix, and re-ran: exact match, 373 vs. 373. https://containarium.dev/blog/gvisor-breaks-kubectl-not-ssh https://containarium.dev/blog/gvisor-breaks-kubectl-not-ssh Sat, 22 Aug 2026 12:00:00 +0000 kubectl port-forward breaks under gVisor; kubectl exec doesn't. We hit the gap independently, then found our own SSH gateway was ALSO broken, for two unrelated reasons we found, root-caused, and fixed. What broke, what we got wrong the first time, and what's proven end to end now. https://containarium.dev/blog/run-untrusted-agent-code https://containarium.dev/blog/run-untrusted-agent-code Tue, 28 Jul 2026 12:00:00 +0000 "Untrusted" is three different threats, and most teams defend the wrong one — shopping for isolation technology while running with unrestricted outbound network access. What a container boundary actually buys you, what it doesn't, and when a box is the wrong tool. https://containarium.dev/blog/scaling-coding-agents https://containarium.dev/blog/scaling-coding-agents Tue, 28 Jul 2026 00:00:00 +0000 Everyone uses a coding agent to write code; almost nobody talks about how to scale one up. Two things made it work for our team — a software quality process the agents actually follow, and one isolated Linux box per agent. Also available in Traditional Chinese: https://containarium.dev/zh-tw/blog/scaling-coding-agents https://containarium.dev/blog/best-ai-agent-sandboxes https://containarium.dev/blog/best-ai-agent-sandboxes Fri, 19 Jun 2026 00:00:00 +0000 Containarium, E2B, Modal, and Daytona side by side on the things that actually decide the choice: self-hosting, persistence, isolation technology, license, MCP support, and cost. Written by a vendor in the space, so it says plainly where each competitor wins.