How Firecracker microVMs work under the hood to sandbox untrusted code and AI agents

Between user code and rogue AI agents, there recently has been huge regain in interest for sanboxing solutions. We've seen last time how to use landlock to drop the privileges