The Revenge of VMs: Sandboxing with NerdBox
summary
Discusses recent changes in container runtimes, notably containerd 2.2, and introduces NerdBox, a new project that manages microVM-based sandboxes with the usability of containers. Emphasizes improved performance, flexibility and security, and the ability to run unrestricted sandboxed environments (useful for AI agents) without requiring root privileges.
AI-written summary · about
chapters (7)
- 0:00NerdBox intro
- 6:25Technical overview
- 10:02Micro-VM operation
- 17:26Kernel optimizations
- 23:44Network demo with GV proxy
- 25:10Maturity and use cases
- 29:19Conclusion
related talks
12mDocker Sandboxes for AI
25mCloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks
26mrm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)
45mContainers are dead. Long live virtual machines!
19mSandbox to confidential containers: A brief on the evolution of container isolation
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
32mLLMs Behind Bars: Sandboxes at Scale for AI on a Short Leash
01h 03mUnderstand your New School (containerized) Operating System