bluebox gives you a sandbox with its own kernel. Not a container sharing yours — a real microVM, booting in about a second, built from one file you can read.

Install anything into it. Break it, fill it with junk, delete half the filesystem. The next command gets a clean machine, and the work you meant to keep is still in /data.

Built on podman and libkrun. The build compares the sandbox kernel against the one a plain container sees, and refuses to hand you a sandbox that only looks isolated.