How the Sentry Intercepts System Calls to Contain Untrusted Agent Code

TL;DR: The Sentry in gVisor mediates every system call from untrusted code, reducing the host attack surface. Learn how interception works and why it matters for When you run model-generated code or