Sandbox guide

CapabilitiesIsolation

Nested virtualisation

You can start virtual machines inside the sandbox, for tools that need their own VM.

4 yes4 with a catch0 no8 not published

Who offers it

Part of Isolation: what kind of computer you get, which explains why it matters.

Fully: Boat, Runtime, Sandboxer and Tensorlake. With a catch: Agent 37, Daytona, Modal and Morph.

  • BoatYes/dev/kvm, no flag

    docs-confirmed “Every sandbox has nested virtualization.” Source

  • RuntimeYes/dev/kvm

    Only sandboxes created after 27 October 2026 on current hosts get it.

    docs-confirmed “expose /dev/kvm” Source

  • SandboxerYes/dev/kvm

    The inner machine's memory comes out of the sandbox's own memory.

    docs-confirmed “/dev/kvm is available: run Firecracker, QEMU/KVM or the Android emulator inside” Source

  • TensorlakeYes/dev/kvm

    GPU sandboxes cannot run nested virtual machines.

    docs-confirmed “Tensorlake Sandboxes have /dev/kvm devices, so you can run virtual machines inside them using any KVM-based hypervisor.” Source

  • Agent 37With a catchVM type only

    The catch: Starting a virtual machine inside needs hardware virtualisation, which only the 2.5x VM type has.

    docs-confirmed “is present inside the machine, so an AVD boots with hardware” Source

  • DaytonaWith a catchLinux VM class only

    The catch: Nested virtual machines only work on the Linux VM class, and the feature has to be switched on for your organisation.

    docs-confirmed “Nested virtualization exposes KVM (/dev/kvm) inside the guest” Source

  • MorphWith a catchexperimental

    The catch: Running another operating system or a virtual machine inside is described as experimental.

    docs-confirmed “There is experimental support for Windows, OSX (x86), and nested virtualization as well.” Source

  • BlaxelNot published

    No page says whether /dev/kvm or nested virtual machines work.

    not-published “Without kernelExtensions, the sandbox's kernel refuses module loading and kernel tracing to every process, including root” Source

  • boxdNot published

    The docs list Docker, kernel modules and systemd but never nested virtual machines.

    not-published “Code in the sandbox can run Docker, load kernel modules, restart systemd, edit /etc, open ports, and break the OS completely” Source

  • Cloudflare SandboxNot published

    Neither the container docs, the FAQ nor the limits page mention nested virtual machines.

    not-published “Maximum vCPU” Source

  • E2BNot published

    No page states whether /dev/kvm or nested virtual machines are available.

    not-published “The E2B sandbox kernel does not ship the xt_owner module” Source

  • InstaBoxNot published

    Nested virtual machines are not mentioned anywhere in the docs.

    not-published “in a Firecracker microVM” Source

  • LizardNot published

    The sandbox docs never mention /dev/kvm or running a virtual machine inside.

    not-published “A Firecracker microVM with its own kernel” Source

  • SpritesNot published

    The docs do not mention /dev/kvm or nested virtual machines.

    not-published “Sprites are persistent, hardware-isolated Linux environments for running arbitrary code.” Source

  • Vercel SandboxNot published

    Vercel's sandbox docs do not mention nested virtual machines or /dev/kvm.

    not-published “Container runtimes: Run Docker and other container engines inside the sandbox” Source

Related

Other capabilities in this feature

Where it decides the choice

The feature

Words used here

  • IsolationHow firmly one machine is kept apart from others on the same hardware. A microVM is a small full computer and is the stronger wall; a container shares more with its neighbours.

Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.