kern: fast rootless container sandbox and virtual resource runtime

kept by eddie aug 28

Kern is a 1.52 MB, daemonless, rootless container runtime that starts kernel-enforced sandboxes from OCI images in ~3.5 ms, with Python/Node SDKs and MCP server for AI-generated code.

Implementing a secure sandbox for local agents
Cursor built OS-level sandboxes for coding agents, reducing approval prompts by 40% via Seatbelt on macOS, Landlock+seccomp on Linux, and WSL2 on Windows.
also on WSL2, #sandboxing, #security, #ai-coding, #developer-tools
Podman rootless containers and the Copy Fail exploit
Podman's rootless containers limit the blast radius of the Copy Fail exploit by using user namespaces to map container root to an unprivileged host user, preventing container escape.
also on Podman, #security
GitHub - apple/container: A tool for creating and running Linux containers using lightweight virtual machines on a Mac. It is written in Swift, and optimized for Apple silicon.
Apple released an open-source tool, `container`, that creates and runs OCI-compatible Linux containers as lightweight VMs on macOS 26+ Apple Silicon Macs.
also on Containerization
Bubblewrap: A nimble way to prevent agents from accessing your .env files
Bubblewrap is a simple sandboxing tool that prevents AI coding agents from accessing sensitive .env files, offering a balance of security and flexibility.
also on #sandboxing, #security, #ai-coding, #developer-tools
Technology | 2025 Stack Overflow Developer Survey
Python adoption accelerated sharply in 2025, Docker saw a record +17 point usage jump, and Rust remained the most admired language, according to the Stack Overflow Developer Survey.
also on Docker, #rust, #ai-coding, #developer-tools