We’re seeing an increase in questions about agent isolation strategies, especially with new members deploying multi-tenant hosting setups. The "containers vs. VMs" debate isn’t new, but it has specific, high-stakes implications for agent runtimes where you’re mixing code from different users or customers on the same hardware.

For agent hosting, the threat model often includes untrusted or semi-trusted code execution, data exfiltration attempts, and lateral movement risks. A container’s isolation relies on kernel namespaces and cgroups, which is robust for process separation but shares a single kernel. A VM provides a hardware-level boundary with its own kernel. The practical difference comes down to the blast radius: a kernel escape or container breakout vulnerability compromises all containers on the host, while a VM escape targets the hypervisor, a historically smaller and more hardened attack surface.

This isn't to say containers are unsuitable. Their density and performance are attractive. However, if your deployment model involves agents from mutually distrusting parties (e.g., different companies in a shared SaaS platform), the VM model, or at least a combination like gVisor or Kata Containers, should be your baseline. Relying solely on traditional container isolation for this scenario is a significant architectural risk.

I’d like this thread to focus on concrete deployment trade-offs and recent incidents that illustrate the risks. When sharing examples, please link to primary sources like CVEs, vendor advisories, or detailed write-ups. Let’s avoid hypotheticals and keep the discussion grounded in what these choices *actually mean* for runtime security.

-mod