> So rather than pick one, this post advocates layering both, in the spirit of defense in depth: a sandbox VM wraps your containers along with the whole toolchain, and that sandbox reaches the internet but has no route to anything private.
It's the first thing the biggest devops guru I know advised me to do. He told me to always ever ever run my containers inside VMs. I religiously followed his advice ever since and I couldn't be happier: I was already doing it before the AI days, to run "normal" containers. Now with these insane agents trying to break out, I'm happy that it's second nature to me.
It's funny that, just like you, I'm using IPv4-only too for those VMs.
I tried GPU-passthrough as a proof-of-concept (worked fine) but I've got no use for it yet.
FWIW all my VMs are running on a 10 years old Xeon / 14 cores / 28 threads / ECC RAM. That's where the agents live.
Thanks for the link to your write-up, very interesting to read from like-minded people and see what's similar and what's different in their solutions.