Replit rebuilt its sandbox engine on microVMs with per-sandbox Linux kernels

Replit has finished a ground-up rewrite of the sandbox engine that powers its coding agents, replacing shared-kernel Docker containers with KVM microVMs that give each sandbox a dedicated Linux kernel. According to Replit's engineering blog, the migration moved hundreds of millions of projects without data loss, and the work was done under an explicit requirement that users not notice anything changing.

The rewrite began in November 2025 and was running internally by February. The new engine now underpins Replit's own platform as well as its Bring Your Own Cloud offering, which runs sandboxes inside customers' AWS, Google Cloud or Azure environments.

A clean start after a decade of containers

Replit has operated sandboxes for nearly ten years, starting with stateless Docker execution spread across Google Compute Engine VMs and gradually layering on persistent workspaces, public endpoints, cached Nix packages, regional clusters and instantly forkable storage. When planning the microVM transition, engineers concluded that building a new runtime from scratch would be easier than porting the old one, an approach that also allowed rapid prototyping without putting the production system at risk.

The core design change is where the isolation boundary sits. Containers still partition processes inside each sandbox, but hardware-assisted virtualization now separates the sandboxes from one another and from the host. Replit picked Cloud Hypervisor as its virtual machine monitor because it shares rust-vmm components with Firecracker while adding virtiofs, transparent huge pages, device hotplug and live migration. Hotplug and memory snapshots let the company keep pools of pre-warmed VMs running and attach customer disks on demand, and the team patched Cloud Hypervisor to make snapshots restore reliably across both bare-metal and virtualized hosts.

Inside each microVM, a minimal init process starts, stops and monitors the containers, communicating with the host over gRPC via vsock, a channel that requires no IP network. A single supervisor handles setup: booting the microVM, configuring networking, launching containers and running the servers clients reach through Replit's river protocol. Nested virtualization means sandboxes can launch VMs of their own, and because each sandbox has its own kernel, Replit can finally offer Docker inside it — privileges it could not safely expose on a shared host kernel.

The sandboxes are general-purpose Linux VMs rather than environments tied to one app-building workflow. The same foundation, combined with access policies, token proxies, audit logging and Replit's ZeroTrust network, now runs the company's internal agents, which investigate incidents, review code, analyze business data and triage support tickets.

Why per-sandbox kernels

The post makes the security case in blunt terms. Linux saw a run of local privilege escalation bugs over the past year — Replit names Copy Fail, both Dirty Frag variants, Fragnesia, DirtyClone, an epoll race condition, Bad Epoll, GhostLock and a FUSE driver flaw — and argues that AI has sped up how quickly such long-lived bugs get discovered. In the old container runtime, which shared the host kernel, one reachable kernel flaw could expose other tenants' workloads, credentials and network endpoints.

With microVMs, compromising a guest kernel does not by itself compromise the host; an attacker still has to cross the virtualization boundary. Replit shrank that boundary further by building the guest kernel from tinyconfig rather than a distribution configuration, dropping Bluetooth, wireless, USB and display drivers, compiling in only what is required and disabling module loading entirely. As part of this work the team audited 6,211 Linux-CNA CVEs published between June 1 and November 4. The virtual machine monitor itself runs under an unprivileged identity with no Linux capabilities.

Defence continues inside the VM. The design uses minimal runc containers, with namespaces, seccomp, device access and capabilities assigned by role, so a user process cannot inherit a monitoring agent's permissions. Supporting services for PostgreSQL, git backups and request proxying run alongside the development environment. Replit considered giving each component its own microVM but decided the overhead was not worth it and changed nothing meaningful about tenant isolation. Daily automation keeps the kernel builds current, with agents built on Replit handling much of the update workflow.

Why it matters

Agent sandboxes have become a crowded category: Replit notes a new sandbox startup appearing every couple of weeks, counts $59.3 million in announced funding across Daytona, E2B, Runloop and Blaxel, and points to open-source efforts like Kubernetes Agent Sandbox and Google's AX and Agent Substrate. Citing the OpenAI Hugging Face incident, Anthropic's evaluation incidents and NIST's agent standards initiative, the company argues that container isolation alone no longer suffices for autonomous agents that touch real systems.

The transferable lessons are the engineering details: per-tenant kernels built from tinyconfig, warm VM pools made viable by snapshot portability, role-scoped privileges inside the virtualization boundary, and the judgement call that a clean rewrite beat an in-place port. A promised second part will cover how Replit orchestrates tens of thousands of microVMs at once on Kubernetes — arguably the part anyone building similar infrastructure will want to read most.