---
title: "Isolation of apps and builds: the while.sh docs"
url: https://while.sh/en/docs/building-blocks/isolation/
updated: 2026-11-09
---

# Isolation

Each app runs isolated under gVisor, and each build, tests included, in its own micro-VM, on a separate cluster.

> You, to your agent: Explain how the app is isolated from the others.

## When to use it

It is always there, without declaring anything: each app and each build are isolated.

## How it works

Each app runs isolated under gVisor, a user-space kernel between it and the machine. Each build, tests included, runs in its own micro-VM, on a separate cluster.

## What to know

An app runs in its environment's space (its namespace), without privileges (Pod Security "restricted") and with quotas. Apps do not run in micro-VMs: only builds do, on a cluster that reaches neither while nor the apps.