kern

kern is a sandbox and virtual resource runtime aimed at workloads you do not trust, including code an AI wrote. It starts a real, kernel-enforced container from an OCI image in roughly 3.5 milliseconds out of a single 1.52 MB static binary, with no daemon and no socket, and it uses no memory at rest because there is nothing running until you invoke it. Isolation comes from Linux namespaces and cgroups rather than a virtual machine. Its only Rust dependency is libc, which is what keeps the binary that small.