Container images and runtimes.
4 items
I unpacked Python images layer by layer and rebuilt them with common Dockerfile habits. A later rm saved nothing on the wire, and half of pandas in the image was its own test suite.
DeepSeek's DSec runs 380,000 concurrent AI-agent sandboxes a day. Not by caching one big image, but by admitting most of a sandbox can never be reused, and building around that instead.
Docker Sandboxes isolates AI agents in microVMs, not containers. Two bugs patched in the same release both broke it at the one place the guest is allowed to talk back to the host.
Container isolation for a fleet of agents costs 48 seconds once and 4.1 kB per agent after — until the bind mount that makes it convenient costs 465 MB each and hands the sharing back.