Flocks names what it actually enforces. There are three isolation classes; each has a precise threat model.
ClassOS supportUseful forHostile-multi-tenant?
ProcessEverywhereDev, single-tenant private meshNo
JailLinux (cgroups + namespaces)Trusted-team private meshPartial
MicroVMLinux (Firecracker)Platform mode, paying tenantsYes
The roost picks the strongest the host supports and refuses to run if the requested floor isn’t met. There is no fallback that silently lowers the trust posture.

​
What each class actually does

​
Process

The agent runs as a child process with its own PID, with nice / ulimit applied. The kernel + filesystem are shared. Adequate for dev, lightweight private meshes, and any deployment where every workload is run by the same operator.

​
Jail

cgroups v2 limit CPU + memory; PID, net, mount, and IPC namespaces isolate the agent from other workloads on the same roost. Suitable for trusted teams; not an answer to hostile multi-tenancy.

​
MicroVM

A Firecracker microVM per workload. Hardware-virtualised KVM boundary; ephemeral rootfs; no shared kernel. This is the threshold for paying tenants on shared roosts.