Sandboxing code execution for AI agents

For those giving their agents the ability to execute code, how are you sandboxing it?

The spectrum seems to be:

• Docker containers: familiar, decent isolation, but heavyweight for per-request sandboxing
• microVMs: great isolation, fast boot, but operational complexity
• WASM: lightweight and fast, but limited ecosystem and capabilities
• Just running it on the host and praying

What I'm trying to solve:

• Agents need to run arbitrary code (user-provided or agent-generated)
• Execution needs to be isolated so a rogue script can't nuke anything
• Ideally fast startup (sub-second) so it doesn't kill the UX
• Needs to support network access for some use cases but not all
• Persistent filesystem between executions for iterative work

What's your setup? What tradeoffs did you accept?