Verdicts · watch

Projects to watch

Genuinely interesting work that is not ready to carry weight in production. These are not bad projects — several are the most technically ambitious things in the ecosystem. They are the ones where the idea has outrun the evidence, and where the right move today is to read, prototype, and keep an eye on release cadence rather than to build a product on top.

How something gets here

Excellent idea, thin evidence

Months of history rather than years, a small maintainer group, and no longitudinal field reports to learn from. Sometimes this is the right architecture and simply needs time.

Honest beta

The maintainers say it is beta and the bug list agrees — boot failures on whole hardware families, snapshot integrity issues, API churn. That honesty is a good sign and a good reason to wait.

Fast-moving category

Where the platform underneath is still settling, the product on top will change shape. Adopting now means adopting the churn along with the capability.

The watch list

Full assessments for the ones with a profile; the rest are grouped with a note on what would change our mind.

Microsandbox

superradcompany/microsandbox

EXPERIMENTAL / EARLY

★ 8.3kforks 443open issues 93created 2024-10-03last push 2026-09-19licence Apache-2.0

Type

Local-first microVM runtime and library aimed squarely at agent sandboxes

Platforms

Linux/KVM, Apple Silicon macOS, Windows via WHP

Agent-specific

Yes — branching, snapshots, allowlisted networking and SDKs are shaped around agent workflows.

Open source

Yes, Apache-2.0

Isolation model

Hardware-isolated microVMs built on a fork of libkrun, with OCI images converting into microVM root filesystems, named long-running sandboxes, live branching, snapshots and restores, and directory/volume concepts. There is no required long-running daemon, and there are Rust, Python, TypeScript and Go SDKs. It is the closest thing in the ecosystem to a purpose-built sandbox backend for an agent product.

Adoption evidence

Eight thousand stars in under two years, a genuinely enthusiastic Hacker News launch (402 points, 186 comments), and organic mentions in other threads about microVM tooling. The creator engages directly with early adopters. It is also labelled beta in its own crate documentation, and independent security work treats its residual-bug posture as the riskiest of the microVM products measured.

Development activity

Very active, with a one-to-three-month release cadence and a changing API surface.

Common complaints

The issue tracker is unusually informative and unusually full. A virtio-fs readdir memory leak under heavy host directory load (npm install was the reproducer), fixed; Windows WHP vCPU triple-faults on AMD Ryzen hardware where every image failed to boot; a Windows "exited before agent relay" failure; boot regressions and boot-argument limit failures traced into the forked libkrun; snapshot restore breaking when an upstream image tag republished (digest mismatch); intermittent guest hangs on first outbound TLS under domain egress rules; secret-substitution failures over both HTTP and HTTPS proxies; and a 2026 CVE where secrets passed on the command line were readable through /proc. Users on VPSs without nested virtualisation found it simply unusable.

Security considerations

The engine-level picture is mixed and the project is honest about why. libkrun has zero published CVEs, no upstream fuzzer and no published academic study, so the negative finding is genuinely ambiguous. The independent study measured eleven of fourteen reachable host primitives, with libkrun shipping no engine-side seccomp filter, and concluded that the operator must stack all the hardening themselves. Leakage measurement, on the other hand, was the cleanest of the microVMs tested. In other words: good at not leaking information, unmeasured at resisting a determined escape.

Interesting features

Live branching of a running sandbox, snapshots and restores, an MCP server, OCI image support without a daemon, a genuinely pleasant SDK surface, and filesystem work that turned into a public engineering post about deleting the filesystem to make it 47 times faster.

Why this rating

This is the most interesting sandbox runtime in the guide and it is not yet something to bet a product on. The recurring failures are not cosmetic: boot failures on whole classes of Windows hardware, snapshot integrity breaks, memory leaks under ordinary npm workloads, and a CVE where credentials were readable from the process listing. Every one of those was fixed promptly, and the maintainers document their own beta status. But complaints per user are high relative to its age, the platform matrix is not uniformly working, and the security posture depends on you stacking hardening the project does not ship.

Our take

Prototype with it. Use it as an optional strong-isolation backend behind an interface, never as the single hard dependency of an application. Pin versions, run it on hardware you have actually tested, and expect to do your own soak testing. If you need microVM isolation in production today and you are Linux-only, the boring answer is still a normal VM or Kata.

Microsoft Execution Containers (MXC)

microsoft/mxc

EXPERIMENTAL / EARLY

★ 1.3kforks 79open issues 84created 2026-02-06last push 2026-09-19licence MIT

Type

Multi-backend sandbox launcher driven by a JSON policy schema

Platforms

Windows 11 24H2+, Linux x64/ARM64, macOS ARM64/x64

Agent-specific

Yes — built for running model output, plugins and tools.

Open source

Yes, MIT

Isolation model

One versioned JSON schema over a pile of backends: AppContainer-style process containers, Windows Sandbox, WSLC, LXC, bubblewrap, Seatbelt, a Hyperlight and NanVix microVM path, and an isolation-session mode that spins a throwaway Windows session. Policy covers filesystem read/write path lists, network proxying and allow/block, plus a UI policy for clipboard, display and GUI access. Stable one-shot backends are processcontainer, bubblewrap, lxc and seatbelt; everything else needs an experimental flag.

Adoption evidence

Backed by Microsoft and announced at Build 2026, with the company's own framing that it is what Copilot CLI uses for dynamically generated code. Developers are starting to adopt its schema vocabulary. Real-world usage evidence is thin because the preview is months old.

Development activity

Very active — commits land daily — but the repository opens with a warning that policies generated by the SDK are known to be overly permissive and will change.

Common complaints

The upstream README is itself the main complaint: "no MXC profiles should be treated as security boundaries currently." Denied paths are not yet supported on Windows. Network policy on Linux and macOS is described as cooperative. The overall picture is an early preview whose abstraction is more mature than its enforcement, and reviewers have begun building their own restricted-token backends instead of adopting it.

Security considerations

Do not treat it as a boundary today. The abstraction is trustworthy — the policy vocabulary is the most complete cross-platform containment description in the open — but several backends are advisory and one (Windows Job Objects in a sibling project) turns out to be process-tree kill-on-close only. Whether a given policy is enforced depends on Windows build number, host OS and backend.

Interesting features

The JSON schema vocabulary for filesystem, network and UI policy; a documented per-Windows-release capability matrix; a state-aware lifecycle (provision → start → exec → stop → deprovision); Windows Sandbox automation including .wsb generation; a Hyperlight microVM backend; and ETW diagnostics for troubleshooting.

Why this rating

It is Microsoft, it is MIT, and it is the single best piece of open documentation for how many ways there are to contain a process on Windows. It is also explicitly not a security boundary yet, with per-version enforcement gaps, and a track record measured in months. The right use today is to steal the schema and the platform knowledge, and to test it in parallel rather than to build on its enforcement.

Our take

Use it as the vocabulary your own policy layer speaks, and as a way to get Windows Sandbox and WSLC launched consistently. Do not ship a promise of security that rests on an MXC profile.

BoxLite

boxlite-ai/boxlite

EXPERIMENTAL / EARLY

★ 2.3kforks 180open issues 294created 2025-12-07last push 2026-09-19licence Apache-2.0

Type

Embeddable microVM runtime for OCI images (local library, CLI and optional server)

Platforms

Linux x86_64/ARM64, Apple Silicon macOS, and Windows only through WSL2. Native Windows is explicitly unsupported, and macOS Intel is listed as coming soon. Linux requires access to /dev/kvm.

Agent-specific

Yes — but for agents in general rather than one agent. It presents itself as 'the compute substrate for AI agents', with an embedded SDK, snapshot/clone and an OCI-image workflow; it is not tied to a particular coding CLI.

Open source

Yes, Apache-2.0, with a security policy that routes reports through GitHub private advisories and states acknowledgement targets.

Isolation model

A hardware-isolated microVM per box. Each box runs its own Linux kernel through libkrun, with KVM on Linux and Hypervisor.framework on macOS, and an OCI container runs inside the guest. The project's architecture notes describe a second layer, a Firecracker-jailer-inspired sandbox around the VMM process: seccomp BPF, namespace and pivot_root isolation, privilege dropping and cgroups v2 on Linux, sandbox-exec on macOS. Storage is a per-box QCOW2 disk with copy-on-write, so a box can be snapshotted, cloned and rolled back. Network egress can be restricted with an allow_net list, and secrets are injected as placeholders so that real values are not placed inside the guest. That is a well-shaped design; every word of it is the vendor's own description, and none of it has been independently measured.

Adoption evidence

An ecosystem list rather than a track record: Databricks Omnigent, Alibaba's AgentScope Runtime and ByteDance's deer-flow name BoxLite as an available sandbox backend in their own repositories and documentation. Those are statements by the consuming projects, and they do establish that integration work happened — they are not evidence of production use, scale or security outcomes. There are SDKs on PyPI, npm and crates.io, and a documented REST API, which shows a deliberate multi-language surface for a young project. GitHub metadata at capture: created December 2025, roughly 2.3k stars, forks in the low hundreds, and an open-issue count in the high hundreds. The guide does not read those numbers as quality; it reads them as a fast-moving young runtime with a busy tracker.

Development activity

Very active. Commits land continuously, releases and SDK versions move quickly, and the repository is under nine months old. Speed is the thing to weigh: a runtime that changes shape weekly is not something to make a long-lived architecture depend on yet.

Common complaints

Too young to have a settled complaint profile, which is itself the finding. The absent-KVM path is handled with a clear error rather than a silent, slower fallback — our own test got 'unsupported: KVM is not available on this host' immediately — which is good behaviour but still means the tool is unusable on hosts without hardware virtualisation, including most cloud VPSs. Expect the usual young-runtime class of reports (platform-specific boot problems, snapshot and networking edge cases) to appear and settle over the next year, and treat any specific one as unverified until it recurs. On a host that did have KVM, the same 0.10.2 line ran an Alpine microVM with guest command execution, networking and root-filesystem persistence across a stop/start, in a one-image smoke test (see experience.html#tested-here). That is execution evidence on one host — it is not a performance figure, and it says nothing about the isolation boundary.

Security considerations

The architecture is the right shape: a per-box kernel, a jailer around the VMM, egress controls and host-side secret injection, which is more than most projects in this space document. The problem is measurement. BoxLite is not in the independent comparative security study of agent sandbox engines, so there is no engine-level reading of its syscall filter, its host attack surface or its CVE history. The only independent measurement of its engine family is that study's libkrun result — no engine-side seccomp and eleven of fourteen host primitives reachable — and while BoxLite documents a jailer layer that the measured libkrun product did not have, that difference is self-reported and untested. It is also very new: no audit, no public fuzzing dashboard, and no time for an escape history to accumulate. Treat the security design as promising and the security claim as unproven.

Interesting features

The 'SQLite for sandboxing' embedding model is the genuinely good idea: a library with no daemon and no root requirement, so an application gets a hardware boundary without standing up any infrastructure. On top of that, persistent boxes that survive restart, clone and snapshot from a running box, full-box export and import as archives, OCI images unchanged, four language SDKs plus a C API and a REST API, allow_net egress control, placeholder secret injection with environment sanitisation, and per-box metrics.

Why this rating

It is one of the few projects aimed exactly at what this guide's readers want: hardware isolation for agent workloads that you can embed on a laptop, with the storage and snapshot story agents actually need, and a platform matrix that is honest about requiring KVM. What is missing is everything that would make it a recommendation — age, independent measurement, a settled issue history, and any production evidence beyond the integrations its consumers advertise. Those are time and search, not design flaws, which is precisely why the verdict is 'experimental' rather than 'skip': worth evaluating, not worth depending on.

Our take

Try it if you are on Linux with /dev/kvm, or on Apple Silicon, and you want the container-free microVM story with persistence. Before you build on it, check two things against your own environment: that a hardware accelerator is genuinely in use on your host, and that your toolchain runs unchanged inside a box. Then decide whether you can absorb its changes — a December 2025 project is going to move, and the honest position on its isolation is that it is documented rather than proven. Do not call it production-ready, and do not call it trusted; nothing in the public record supports either word yet.

omnigent-ai/omnigent

EXPERIMENTAL / EARLY

Databricks' meta-harness with a bundled Omnibox OS sandbox. Enormous star count, eight weeks of history, and a Windows backend that only kills processes.

Agent orchestrator / GUIagent-specificlinux · macos · windows

★ 10k issues 1.4k pushed 2026-09-19 lic Apache-2.0 GitHub ↗project site ↗

NVIDIA/OpenShell

EXPERIMENTAL / EARLY

NVIDIA's policy-controlled runtime for autonomous agents. Serious backing, six months of history.

Agent sandbox wrapperagent-specificlinux

★ 8.7k issues 530 pushed 2026-09-19 lic Apache-2.0 GitHub ↗project site ↗

superradcompany/microsandbox

EXPERIMENTAL / EARLY

The closest thing to a purpose-built sandbox backend for agents: libkrun microVMs, branching, snapshots, SDKs. Also explicitly beta, with a documented history of boot failures, a virtiofs leak and a secrets-in-argv CVE. → full assessment

MicroVM / lightweight VMMagent-specificlinux · macos · windows

★ 8.3k issues 93 pushed 2026-09-19 lic Apache-2.0 GitHub ↗project site ↗

smol-machines/smolvm

EXPERIMENTAL / EARLY

Branchable local microVMs. Six thousand stars, most of them recent.

MicroVM / lightweight VMMagent-specificlinux · macos

★ 6.1k issues 82 pushed 2026-09-19 lic Apache-2.0 GitHub ↗project site ↗

hyperlight-dev/hyperlight

EXPERIMENTAL / EARLY

Microsoft Research's embedded hypervisor for function-shaped code. Blisteringly fast, and it is one of MXC's microVM backends.

MicroVM / lightweight VMMlinux · windows

★ 4.7k issues 220 pushed 2026-09-18 lic Apache-2.0 GitHub ↗project site ↗

nanovms/nanos

EXPERIMENTAL / EARLY

A unikernel that runs one application. Tiny and fast; awkward if your 'application' is a shell.

Full VM / hypervisorlinux

★ 3.2k issues 87 pushed 2026-09-19 lic Apache-2.0 GitHub ↗project site ↗

boxlite-ai/boxlite

EXPERIMENTAL / EARLY

Local KVM/Hypervisor.framework microVM runtime you embed or run as a binary: OCI images run inside a per-box VM with its own kernel, with snapshots, copy-on-write QCOW2 disks and placeholder secret injection. Needs /dev/kvm on Linux; Windows only through WSL2. Young, and not independently measured. → full assessment

MicroVM / lightweight VMMagent-specificlinux · macos · windows

★ 2.3k issues 294 pushed 2026-09-19 lic Apache-2.0 GitHub ↗project site ↗

earendil-works/gondolin

EXPERIMENTAL / EARLY

QEMU microVMs behind a TypeScript policy layer, with a written threat model that says what it trusts.

MicroVM / lightweight VMMagent-specificlinux · macos

★ 2.2k issues 47 pushed 2026-07-06 lic Apache-2.0 GitHub ↗project site ↗

eugene1g/agent-safehouse

EXPERIMENTAL / EARLY

Deny-first Seatbelt profiles for macOS. Good defaults for a platform whose sandbox is unofficially deprecated.

Agent sandbox wrapperagent-specificmacos

★ 2.1k issues 24 pushed 2026-09-18 lic Apache-2.0 GitHub ↗project site ↗

e2b-dev/desktop

EXPERIMENTAL / EARLY

E2B's desktop image for computer-use agents, with view-only and password-protected streams.

Computer-use / desktop automationagent-specificcloud

★ 1.5k issues 11 pushed 2026-09-18 lic Apache-2.0 GitHub ↗project site ↗

microsoft/mxc

EXPERIMENTAL / EARLY

Microsoft Execution Containers: one JSON schema over AppContainer, Windows Sandbox, bubblewrap, LXC, Seatbelt, microVMs and Hyperlight. Its own README says no profile is a security boundary yet. → full assessment

Windows containmentagent-specificlinux · macos · windows

★ 1.3k issues 84 pushed 2026-09-19 lic MIT GitHub ↗

clawkwork/clawk

EXPERIMENTAL / EARLY

Disposable network-restricted Linux VMs, macOS-first, with one of the best discussion threads in the space.

MicroVM / lightweight VMMagent-specificlinux · macos

★ 1k issues 4 pushed 2026-08-13 lic Apache-2.0 GitHub ↗

fencesandbox/fence

EXPERIMENTAL / EARLY

Clean, well-documented, container-free sandbox that is refreshingly explicit about what it does not protect against.

Agent sandbox wrapperagent-specificlinux · macos

★ 969 issues 34 pushed 2026-09-10 lic Apache-2.0 GitHub ↗project site ↗

instavm/coderunner

EXPERIMENTAL / EARLY

Apple-container agent sandbox with a cloud path attached.

MicroVM / lightweight VMMagent-specificmacos

★ 894 issues 9 pushed 2026-08-13 lic Apache-2.0 GitHub ↗project site ↗

Katakate/k7

EXPERIMENTAL / EARLY

Self-hosted lightweight VM sandbox infra with API/SDK. Kubernetes-shaped.

MicroVM / lightweight VMMagent-specificlinux

★ 808 issues 0 pushed 2026-09-14 lic Apache-2.0 GitHub ↗project site ↗

finbarr/yolobox

EXPERIMENTAL / EARLY

Docker with snapshots and sudo inside. Convenient, explicitly not an escape barrier.

Agent sandbox wrapperagent-specificlinux · macos

★ 643 issues 2 pushed 2026-08-28 lic MIT GitHub ↗

jingkaihe/matchlock

EXPERIMENTAL / EARLY

Linux agent sandbox with a clean CLI. Six hundred stars, one main author.

Agent sandbox wrapperagent-specificlinux

★ 621 issues 9 pushed 2026-07-26 lic MIT GitHub ↗

manuelschipper/nah

EXPERIMENTAL / EARLY

Deterministic allow/ask/block guard. Four hundred stars, narrow scope, honest design.

Policy, approval & auditagent-specificlinux · macos

★ 486 issues 0 pushed 2026-09-15 lic MIT GitHub ↗project site ↗

nikvdp/cco

EXPERIMENTAL / EARLY

Thin launcher that picks a local backend. Useful as a menu of options.

Agent sandbox wrapperagent-specificlinux · macos

★ 425 issues 2 pushed 2026-09-12 lic MIT GitHub ↗

webcoyote/sandvault

EXPERIMENTAL / EARLY

Separate macOS user account plus sandbox-exec. Cheap and practical, and the author says he uses it most days.

Agent sandbox wrapperagent-specificmacos

★ 417 issues 1 pushed 2026-09-14 lic Apache-2.0 GitHub ↗

landlock-lsm/island

EXPERIMENTAL / EARLY

Landlock-powered CLI sandbox. Three hundred stars, and last touched in May 2026.

Process sandbox (OS primitives)agent-specificlinux

★ 334 issues 21 pushed 2026-05-26 lic Apache-2.0 GitHub ↗

GreyhavenHQ/greywall

EXPERIMENTAL / EARLY

Container-free, deny-by-default, with kernel-level TUN capture on Linux and host-side credential substitution.

Agent sandbox wrapperagent-specificlinux · macos

★ 298 issues 24 pushed 2026-08-13 lic Apache-2.0 GitHub ↗project site ↗

eqtylab/cupcake

EXPERIMENTAL / EARLY

OPA/Rego hook enforcement for coding agents. Real policy language, real immaturity.

Policy, approval & auditagent-specificlinux · macos

★ 293 issues 22 pushed 2026-03-02 lic Apache-2.0 GitHub ↗project site ↗

nanvix/nanvix

EXPERIMENTAL / EARLY

A purpose-built VM and OS that boots in a blink. Now wired into MXC as its microVM backend.

MicroVM / lightweight VMMlinux · windows

★ 282 issues 244 pushed 2026-09-19 lic MIT GitHub ↗project site ↗

butter-dot-dev/bVisor

EXPERIMENTAL / EARLY

A Zig application kernel for bash. Two milliseconds to boot, one developer, one star count.

Application kernellinux

★ 217 issues 1 pushed 2026-02-23 lic Apache-2.0 GitHub ↗

kstenerud/yoloai

EXPERIMENTAL / EARLY

One wrapper, many backends, copy/diff/apply review workflow. The complexity of many backends is the price.

Agent sandbox wrapperagent-specificlinux · macos · windows

★ 212 issues 9 pushed 2026-08-21 lic MIT GitHub ↗project site ↗

webcoyote/clodpod

EXPERIMENTAL / EARLY

Agents inside a macOS VM over shared folders. Heavier sibling of SandVault.

Full VM / hypervisoragent-specificmacos

★ 187 issues 4 pushed 2026-08-30 lic Apache-2.0 GitHub ↗

postrv/forgemax

EXPERIMENTAL / EARLY

MCP gateway that collapses many servers into sandboxed code execution.

Agent sandbox wrapperagent-specificlinux · macos

★ 151 issues 3 pushed 2026-09-10 lic NOASSERTION GitHub ↗

jgbrwn/vibebin

EXPERIMENTAL / EARLY

Persistent Incus containers on your own VPS. The right shape for a worker machine.

Container / namespaceagent-specificlinux

★ 108 issues 0 pushed 2026-08-10 lic NOASSERTION GitHub ↗

LuD1161/agentjail

EXPERIMENTAL / EARLY

Policy checks on every tool call plus an optional kernel sandbox. Small, ambitious, unproven.

Agent sandbox wrapperagent-specificlinux · macos

★ 94 issues 2 pushed 2026-09-08 lic Apache-2.0 GitHub ↗project site ↗

swelljoe/flar

EXPERIMENTAL / EARLY

Fast and light bubblewrap wrapper that is honest in its README about being far less tested.

Agent sandbox wrapperagent-specificlinux

★ 55 issues 6 pushed 2026-08-18 lic Apache-2.0 GitHub ↗

pjlsergeant/byre

EXPERIMENTAL / EARLY

A comfortable constrained container around any folder. Its README is the best example of a tool that states its own limits.

Agent sandbox wrapperagent-specificlinux · macos

★ 32 issues 1 pushed 2026-09-17 lic MIT GitHub ↗project site ↗

agentic-dev3o/sandbox-shell

EXPERIMENTAL / EARLY

Seatbelt shell wrapper for developers worried about SSH/AWS/GPG keys.

Agent sandbox wrapperagent-specificmacos

★ 30 issues 1 pushed 2026-09-18 lic MIT GitHub ↗

recodelabs/lima-devbox

EXPERIMENTAL / EARLY

A skill that convinces Lima to build you an agent VM. Small, but it points at the right primitive.

Full VM / hypervisoragent-specificmacos

★ 28 issues 1 pushed 2026-07-03 lic MIT GitHub ↗

corv89/shannot

EXPERIMENTAL / EARLY

Human-in-the-loop approval flow. Twenty-six stars.

Policy, approval & auditagent-specificlinux · macosarchived

★ 26 issues 6 pushed 2026-04-13 lic Apache-2.0 GitHub ↗project site ↗

binwiederhier/sandclaude

EXPERIMENTAL / EARLY

Opinionated Docker wrapper for Claude Code. Twenty-three stars.

Agent sandbox wrapperagent-specificlinux · macos

★ 23 issues 0 pushed 2026-05-30 lic Apache-2.0 GitHub ↗

agentcage/agentcage

EXPERIMENTAL / EARLY

Defense-in-depth proxy cage with fail-closed behaviour. Twenty-two stars and not audited.

Agent sandbox wrapperagent-specificlinux · macos

★ 22 issues 29 pushed 2026-09-19 lic MIT GitHub ↗

jskswamy/aide

EXPERIMENTAL / EARLY

One command, capability grants, SOPS secrets. Young.

Agent sandbox wrapperagent-specificlinux · macos

★ 17 issues 2 pushed 2026-09-17 lic MIT GitHub ↗

tarsgate/skynot

EXPERIMENTAL / EARLY

Dedicated-user install pattern with shared ACLs. Sixteen stars.

Agent sandbox wrapperagent-specificlinux

★ 16 issues 6 pushed 2026-06-18 lic NOASSERTION GitHub ↗project site ↗

ashishgituser/bunkervm

EXPERIMENTAL / EARLY

Time-travel debugging for agent microVMs (record and replay). One star, genuinely interesting idea.

Agent sandbox wrapperagent-specificlinux

★ 1 issues 0 pushed 2026-08-18 lic MIT GitHub ↗project site ↗

What would move these off the watch list

Signal	Why it matters	Who is closest
A year of issue history with no recurring failure family	The single best predictor of a sandbox you can rely on. Recurring families — the same boot failure, the same leak, the same snapshot bug — are the thing that turns a weekend tool into a maintenance burden.	Nothing in this list yet; every one of them is measured in months.
Platform parity, or an explicit statement of what is unsupported	"Works on Linux and macOS" plus a broken Windows path is the most common shape in this space. Either real parity or honest scope.	Several are honest about it, which is why they are rated here rather than lower.
A second and third maintainer with commit rights	Bus factor. Anything with a single author is one holiday away from becoming a frozen dependency.	The Rust microVM runtimes have the widest contributor bases.
Engine-side hardening shipped by default, not left to the operator	If a runtime ships no seccomp filter and expects you to stack every layer yourself, the default configuration is not safe.	Firecracker and gVisor already do this; the libkrun-based projects do not.
An independent audit, or a public fuzzing dashboard	Both convert "no known bugs" into an actual measurement. Absence of advisories is absence of search until somebody looks.	gVisor is the only product in this space with a continuous public fuzzer.
Someone other than the author reporting it working in production	The cheapest possible evidence and the hardest to fake. A blog post, a case study, a third-party integration.	A handful have this; most do not.

The one thing worth doing with all of them

Read their design documents. The most useful output of an immature project is not code you can run, it is a design someone arrived at independently — a policy schema, a threat model that names its own assumptions, a credential flow, a workspace strategy. Several projects on this list have already produced ideas that made it into the guide's recommendations, and the cost of reading them is an hour.