SANDBOXING AND ISOLATION FOR SAFETY

KEY TERMS REVIEW Sandbox: a fenced-off area where a program cannot touch the outside. Container: a lightweight isolated package for a program. VM: a simulated computer inside a real one. Egress: traffic leaving a system. Allow-list: a list of approved destinations, with all others blocked. Resource limit: a cap on memory, processor time, disk, or run time. CHECK YOUR UNDERSTANDING • Why is sandboxing called a last line of defense? ◦ Answer: It still limits damage when the model has been fooled. • How does a virtual machine differ from a container? ◦ Answer: It simulates a whole computer with a stronger wall but more weight. • What does an egress allow-list do? ◦ Answer: It permits only approved destinations and blocks all others. • Why set resource limits? ◦ Answer: To stop accidents like endless loops and abuse that overloads shared hardware. • Name an unsolved problem in safe execution. ◦ Answer: Preventing small leaks through allowed channels, such as request timing patterns.