Which group of container runtimes provides additional sandboxed isolation and elevated security?

`rune` is a low-level OCI runtime, and `cgroups` are a Linux kernel feature for resource management, neither of which provides elevated sandboxed isolation.

`docker` and `containerd` are traditional container runtimes that provide process-level isolation, but not the elevated sandboxed isolation offered by gVisor or Kata Containers.

`runsc` (the runtime for gVisor) and `kata` (Kata Containers) are designed to provide stronger sandboxed isolation for containers. `runsc` achieves this by intercepting system calls and running them through a user-space kernel, while Kata Containers use lightweight virtual machines (VMs) for each container, providing kernel-level isolation.

`crun` is another OCI-compliant container runtime, and `cri-o` is a high-level container runtime implementing CRI; neither inherently provides additional sandboxed isolation beyond traditional runtimes.