sourcediver

AI datacenters are like nuclear power plants. Each user only consumes a fraction of its (compute) power but no single user can afford to build one themselves. There is no "tiny" nuclear power plant.

While local models do work, frontier models (like GLM 5.2) require huge amounts of memory which translates to high upfront costs that in the end demand high utilization to increase the ROI - if you can even afford such machines. This engineering effort is also adding to the cost of the hardware. Because of these factors, models like GLM 5.2 will still be served from data centers for a while (just not the ones of OpenAI, Anthropic, Google etc.) until the hardware becomes so cheap that you can afford to keep it not fully utilized.

You cannot execute (docker) containers securely within another container which also limits what you can do with any agent (DinD). A coding agent that generates a `Dockerfile` would surely benefit from starting a container with it. And generally speaking, as a another commenter explained, name-spacing does not give you the full host isolation that you are looking for when running truly untrusted code which is the reality when using agents.

I strongly believe that we will see MicroVMs becoming a staple tool in software development soon, as containers are never covered all the security threats nor have the abilities that you would expect from a "true" sandbox.

I wrote a blog post that goes a bit into detail [1].

Let's see whether Docker (the company) defines this tooling, but I'd say that they are on a good path. However in the end I'd expect it to be a standalone application and ecosystem, not tied to docker/moby being my container runtime.

[1] https://sourcediver.org/posts/260214_development_sandboxes/

thanks. fixed it.