Kern: rootless containers that cold-start in ~3.5 ms, from a single 1.5 MB binary
Kern is a single 1.52 MB static binary that boots a real, kernel-enforced rootless container from an OCI image in ~3.5 ms, with no daemon, socket, or RAM at rest. It folds sandboxing and resource control into that one file, and ships an MCP server so agents can run their own untrusted and AI-generated code. The caveat: isolation rides on unprivileged user namespaces, so it suits code you chose to run, not hostile strangers.