Sandbox Claude Code and Codex 2026: Docker, gVisor, microVM

Docker, gVisor or microVM for Claude Code and Codex CLI? Threat model, hardened docker run, runsc setup, and what each vendor sandbox covers.