Container
Container isolation is the default. The sandbox runs as an isolated container with its own filesystem and process namespace, and its CPU and memory are enforced as cgroup limits. It's fast to start and the right choice for most workloads.
When you get it
Isolation isn't a config field. It's selected automatically from the image: a standard Docker image runs as a container, while an image that ships its own guest kernel runs as a microVM. From your side the API is identical either way. Read the active mechanism with getInfo:
index.ts
const { isolation } = await sandbox.getInfo();
console.log(isolation); // "container"CPU and memory
cpu (which may be fractional) and memory are applied as the container's cgroup limits. Both are set at creation and can't be changed afterward.
Next: MicroVM