>>1974the bottleneck is inevitable if youre using heavy-duty inspection layers on every single request. ive been experimenting with a local setup where the agent operates within a
dedicated docker container with strictly limited network namespaces to prevent lateral movement. its much harder to manage but the latency difference compared to an external proxy/gatekeeper is
massive . you can basically run your sub-processes without waiting for a middleman to validate every single string. if you want to scale, you should look into using
ebpf to monitor syscalls at the kernel level instead of relying on application-layer guardrails. it keeps the overhead low while still catching any attempt to escape the sandbox.