PlatformIsolation

Isolation

Browse research on stronger execution boundaries, isolation backends, and mount-lifetime policy.

This collection studies isolation backends and filesystem policies that could strengthen or complement the current container boundary.

smolvm backend

MicroVM integration shape, operational constraints, and open validation work.

OrbStack isolated machines

Stronger OrbStack boundaries and their fit with jackin❯ workspaces.

Apple Container backend

Backend design for Apple's container runtime.

Apple Container landscape

Current ecosystem evidence, security properties, and implementation signals.

Ephemeral mount modes

Workspace mount lifetimes and cleanup trade-offs.

Source-branch policy

Branch safety rules for isolated mounts.

In-capsule dirty-exit design rationale

Records the failure model and recovery design for preserving capsule state after an agent exits with uncommitted changes.

smolvm backend

Evaluates smolvm as an open macOS microVM backend for workloads that need stronger isolation than hardened Docker.