Comment by zavec

This looks really promising, I am curious about the choice to use containers as the isolation layer though. If the goal is to treat agents as untrusted and isolate them fully I feel like microVMs would be a better option.

If it supports OCI runtimes though then maybe kata containers can be plugged in, I'll have to dig in after work and see.