Research question
Which layer of the sandbox stack does each leading project address?
Key findings
- Popularity cannot replace maintenance status, security evidence, or verified compatibility.
- Managed providers, unified APIs, microVM data planes, and policy runtimes are distinct approaches.
- Selection should start with workload and trust boundaries, not feature checklists.
Method and limitations
This version is desk research based on public repositories, official documentation, and architecture material. Vendor claims about performance, security, and compatibility require independent experiments on pinned versions before becoming Live Verified.