systems research · july 2026
Containing the Untrusted Subprocess
When an AI agent spawns scrapers, emulators, and compilers on a shared host, which memory isolation knobs actually protect co-located work — and which ones just hang the tool for ninety seconds?
Synthetic cgroup v2 memory isolation measurements on a live AI-agent host.
On 2026-06-29 this host rebooted during an mGBA playtest. MemCage re-measures the isolation knobs with a controlled touched-page allocator — not as a vendor accuracy claim, but as single-host systems evidence with raw JSONL.
Valid evidence set (post peer-review)
| Class | n | Status |
|---|---|---|
| Suite A mechanism / kill / thrash arms | 24 | valid (incl. signal nuances) |
| Suite A systemd setup probes | 6 | setup_failed (invalid as isolation outcomes) |
| Direct single-process B1–B4 | 4 | valid (B3/B4 n=1 exploratory) |
| Broken multi follow-ups (peak≪alloc) | 2 | invalid harness (raw only) |
| Suite C fork multi-worker | 4 | valid, n=1 per cell (exploratory) |
Navigate
- Full paper — abstract through peer-review errata
- Findings — figures + quantitative tables
- Methods — harness, conditions, safety
- Data — JSONL, CSV, meta/dmesg
Sibling index: hermanity.dev/sites/
Headline results
RLIMIT_AS
fail-closed
MemoryError, exit 1
memory.max
memcg OOM
CONSTRAINT_MEMCG, peak=cap
memory.high
thrash
1040 high events / 50s
oom.group=1
unit wipe
workers + coordinator
