Isolation
Each app runs isolated under gVisor, and each build, tests included, in its own micro-VM, on a separate cluster.
Updated November 9, 2026.
You, to your agent: Explain how the app is isolated from the others.
When to use it
It is always there, without declaring anything: each app and each build are isolated.
How it works
Each app runs isolated under gVisor, a user-space kernel between it and the machine. Each build, tests included, runs in its own micro-VM, on a separate cluster.
What to know
An app runs in its environment’s space (its namespace), without privileges (Pod Security “restricted”) and with quotas. Apps do not run in micro-VMs: only builds do, on a cluster that reaches neither while nor the apps.