microVM sandbox
Also known as: microVM isolation, Firecracker sandbox, microVM-based agent isolation
A sandbox is a contained environment where agent-generated code can run without touching the host system or other tenants. Containers (like Docker) offer one level of isolation, but they share the host kernel, which means a container escape gives an attacker access to the kernel. A microVM goes further: each sandbox gets its own guest kernel, so even if code inside the VM exploits the guest kernel, it still has to break out of the hardware virtualization layer to reach the host.
Firecracker, originally built by AWS for Lambda and Fargate, is the most commonly cited engine in the agent sandbox space. It is designed to boot a minimal Linux kernel in well under a second, which makes it practical to spin up a fresh VM per agent task rather than reusing a shared environment across sessions. E2B and Perplexity SPACE both use Firecracker as their isolation layer.
The tradeoff versus containers is overhead: microVMs consume more memory and take slightly longer to start than a container, though production systems have pushed create times to 60-185 ms depending on the implementation. For builders, the choice matters when agent code has real authority: anything that writes files, makes network calls, or runs shell commands is a candidate for microVM isolation, especially when the code is generated by the model itself and hasn't been reviewed before execution.