给 AI Agent 提供安全、快速、可扩展的沙箱运行时，基于 Kubernetes 隔离执行环境，防止智能体代码越权或污染宿主。
为容器提供用户态内核，在 Go 中实现 Linux 系统调用接口，让 Docker 和 Kubernetes 容器获得更强的安全隔离，同时保持 OCI 兼容。
…z Move to PATH sudo mv temps /usr/local/bin/temps Firecracker sandboxes only: temps firecracker setup looks for the guest agent next to the temps binary sudo mv temps-vm-a
…security vulnerabilities reported by Dependabot - firecracker: Say why micro vm deployments are refused ([ 1676](https://github.com/gotempsh/temps/issues/1676)) The comple
…z Move to PATH sudo mv temps /usr/local/bin/temps Firecracker sandboxes only: temps firecracker setup looks for the guest agent next to the temps binary sudo mv temps-vm-a
…sts; Ruff lint and formatting checks. Libkrun and Firecracker were unavailable on the macOS qualification machine; their ELF artifact was build- and checksum-verified, wit
…z Move to PATH sudo mv temps /usr/local/bin/temps Firecracker sandboxes only: temps firecracker setup looks for the guest agent next to the temps binary sudo mv temps-vm-a
… as root , where before it did not. Confining the Firecracker VMM requires privileges that enabling KVM does not grant: mknod to create the sandbox's /dev/kvm , chown to h