CapabilitiesIsolation
Its own virtual machine
Each sandbox is a separate virtual machine (microVM or full VM), not a container sharing a kernel with neighbours.
Who offers it
Part of Isolation: what kind of computer you get, which explains why it matters.
Fully: Blaxel, Boat, boxd, Cloudflare Sandbox, E2B, InstaBox, Lizard, Morph, Runtime, Sandboxer, Sprites and Vercel Sandbox. With a catch: Agent 37, Daytona, Modal and Tensorlake.
Each sandbox is a microVM with its own kernel; the default kernel refuses module loading.
docs-confirmed “the microVM boundary remains the isolation guarantee between your sandbox and everything else.” Source
docs-confirmed “Each sandbox is a full Linux virtual machine with its own kernel.” Source
docs-confirmed “Every boxd machine is a KVM microVM with its own kernel, network stack, and disk.” Source
One microVM per container; inside it every process is root, so there is no separation between users in one sandbox.
docs-confirmed “Each container instance runs in a Firecracker microVM with its own kernel and network.” Source
docs-confirmed “Every sandbox is a Firecracker microVM, not a container.” Source
docs-confirmed “in a Firecracker microVM” Source
Older sandboxes created before the October 2026 change were pods on a shared kernel.
docs-confirmed “Sandboxes run as Firecracker microVMs, each with its own kernel.” Source
docs-confirmed “Full virtual machines capable of running any configuration of containers” Source
docs-confirmed “Every sandbox is a Firecracker microVM. It has its own Linux kernel and disk.” Source
docs-confirmed “Each sandbox is a separate Cloud Hypervisor microVM with its own kernel.” Source
No systemd: a built-in service manager starts services when the machine wakes.
docs-confirmed “Sprites are persistent, hardware-isolated Linux VMs on Fly.io for AI agents, dev environments and untrusted code, billed by the second and free when idle.” Source
docs-confirmed “each sandbox runs in its own Firecracker microVM with a dedicated kernel.” Source
The catch: The standard machine is a gVisor container, which is not a computer of its own; a true virtual machine with its own kernel is a separate type at 2.5 times the price.
The vm type adds Docker, Kubernetes and Android emulators.
docs-confirmed “Every sandbox is enforced by gVisor, with its own filesystem and a hard disk quota.” Source
The catch: By default each sandbox is a container sharing the host's kernel; a real virtual machine is a separate kind you have to choose.
docs-confirmed “Sandboxes run as Linux containers by default.” Source
The catch: The default is a gVisor container, which is not a computer of its own; a true virtual machine with its own kernel is a separate runtime you have to ask for.
docs-confirmed “VMs run the Sandbox in a virtual machine with its own Linux kernel.” Source
The catch: The ordinary machines are real virtual machines, but the graphics-card machines you have to ask for are containers instead.
Graphics sandboxes are the exception; the standard CPU machines have their own kernel.
docs-confirmed “GPU sandboxes use gVisor while CPU-only sandboxes run in VMs.” Source
Related
Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.