Google Described Its Agent Sandbox. I Built One with Firecracker and Measured It

A Go rebuild of Google's Agent Compute Engine pattern was built using Firecracker, featuring copy-on-write snapshot forks, idle-aware hibernation, and a NIC-less guest with a credential-injecting proxy. The implementation was measured on bare metal and under nested virtualization.