Pick your isolation strength (gVisor, a Firecracker microVM, a hosted sandbox, or hardened Docker) behind one `run` call, and run it off your app host so an escape can't reach your database or secrets. Zero runtime dependencies — stdlib only.