Containerized, keel-driven AI development sandboxes — no host bind mount, default-deny egress, tamper-evident audit trail
Description excerpted from the original listing, which is linked below.