Aside from hiding agent credentials from the agent, it also runs an isolated Docker Engine for the agent to use freely.

The credentials part...

https://docs.docker.com/ai/sandboxes/security/credentials/

It seems to do a good job of not stating the actual threat model anywhere.

Yes, pretty much, except for one detail:

> That runs the codex OCI in a qemu microvm.

AFAIU it's actually the other way around: krun spawns a libkrun-based (not QEMU-based) VM inside a crun container. Source: https://github.com/libkrun/libkrun/discussions/538#discussio...

So with your solution you get the additional security benefit of containerizing the hypervisor on the host.

Once you have a vm, the container provides next to no additional security benefits. It's just unnecessary overhead at that point.

That's not correct. Virtio devices have different security properties and many of them expose the host system to considerable risks. Using containerization on the host is one way to limit the latter. See e.g. https://github.com/libkrun/libkrun/#security-model for more details.

Well, I stand corrected! Thanks for the link