Replit rebuilds its sandbox engine around microVMs

Replit has published part 1 of a two-part engineering post describing a complete rewrite of its sandbox engine. The old runtime used Linux containers that share the host kernel. The new one gives each sandbox its own microVM, a lightweight virtual machine with its own Linux kernel, with minimal runc containers running inside it. Replit says it has run sandboxes for nearly a decade and finished the rollout "in the past few months" to improve security, capabilities and portability across clouds, including its Bring Your Own Cloud offering for customers' AWS, Google Cloud or Azure environments. It says it migrated hundreds of millions of projects without data loss.

The timeline, per the post: the rebuild began in November 2025, aimed at more autonomous agents, persistent workspaces and much higher concurrency. The new engine was in internal use by February, and the following months went to hardening and rollout. The old engine began as stateless code execution in Docker across Google Compute Engine VMs, then gained persistent workspaces, public endpoints, cached Nix packages, regional clusters and bottomless storage with instant disk forks. Replit decided it was easier to start from scratch than to port the Docker-based runtime to microVMs, which also let it prototype without risking the existing system.

The design: KVM separates each sandbox from the host and from other customers' workloads, while containers still separate processes inside each sandbox. Replit chose Cloud Hypervisor as the virtual machine monitor. It shares reusable rust-vmm components with Firecracker and offers virtiofs, transparent huge pages, device hotplug and live migration. Hotplug and memory snapshots let Replit attach customers' disks on demand to warm-pooled VMs, and Replit patched Cloud Hypervisor to improve snapshot portability across its bare-metal and virtualized environments. Nested virtualization lets development environments launch VMs of their own. A minimal init process in each microVM manages the containers and talks to the host over gRPC on vsock. Replit considered one microVM per component but judged the extra overhead not worth it. The VMM runs under an unprivileged identity with no Linux capabilities. Namespaces, seccomp, device access and capabilities are set by role, so a user process does not inherit a monitoring agent's permissions.

The security argument: Replit lists a run of Linux kernel local privilege escalation bugs over the past year (Copy Fail, Dirty Frag, Fragnesia, DirtyClone, Bad Epoll, GhostLock and others) and says AI has increased the rate at which such bugs are found, though many have existed for years. With a shared kernel, a reachable vulnerability can let an attacker escape a container and reach other workloads, credentials or network endpoints on the host. The post concedes that not every kernel CVE is exploitable in every configuration. With microVMs, compromising a guest kernel does not by itself compromise the host kernel; the attacker still has to cross the virtualization boundary. A separate kernel per sandbox also lets Replit support Docker, which needs privileges it could not safely expose in the shared-kernel runtime. Docker gets those privileges only inside the guest.

The guest kernel starts from tinyconfig rather than a distribution configuration. Bluetooth, wireless, USB and display drivers are left out, required drivers are built in, and module loading is disabled at guest initialization. Replit says daily automation, with agents built on Replit, keeps kernel builds current. It audited 6,211 Linux-CNA CVEs published from June 1 through November 4, 2026, using CVEProject and kernel.org records, and says it avoided 5,969 of them (96.1%) by incorporating upstream fixes or excluding the affected code. Of the audited CVEs, 4,375 fixes (70.4%) landed even before disclosure, and 676 (10.9%) more were excluded by configuration. At least 15 of the avoided CVEs are explicitly described by the Linux CNA or Red Hat as enabling or potentially enabling local privilege escalation. As an example, Replit cites CVE-2026-98432, the Linux TCP flaw Anthropic demonstrated could give a remote attacker root access: it says it incorporated the fixed kernel on October 12, before the CVE was published and more than two weeks before Anthropic described its exploit.

Runtime defence: each sandbox has one security monitor spanning the host and guest sides of the microVM, using eBPF to observe process execution, file access and network activity and Linux Security Modules to enforce restrictions at the kernel boundary. Runtime telemetry feeds autonomous agents that keep evolving the known detections and forbidden patterns. The monitor is supervised and restarts itself after a crash, tampering or a new rollout. Replit says the security component can be updated and hot-reloaded across all production sandboxes in less than 15 minutes after changes are merged, and that working at the kernel level lets it apply ad hoc remediations for zero-day kernel exploits even before a fix reaches mainline. As another example, when eMudhra's intermediate CA keys were compromised, the sandbox harness injected an updated CA bundle into all running sandboxes.

Networking: every sandbox can use the same private IP addresses because it has its own network namespace and routing table; Linux virtual routing and forwarding keeps the overlapping networks apart. Baseline firewall rules restrict access to cloud metadata and infrastructure address ranges. For sandboxes with an egress policy, enforcement runs outside the guest: a host-side proxy checks TLS handshake hostnames without decrypting application payloads, filters DNS and rejects traffic outside the permitted path, and the guest cannot disable those rules. Virtual-NIC rate limiters enforce bandwidth limits outside the guest too. For credentials, managed connectors to services such as GitHub and Google Docs use brokers that attach the upstream credential after authorization, so the workload never receives its account API key.

The post also frames the work against the industry: it points to agent-containment incidents, a NIST agent standards initiative, and startup rounds that it says totaled $59.3 million across Daytona, E2B, Runloop and Blaxel. It adds that the same microVM foundation runs Replit's own internal agents, which investigate incidents, review code, analyze business data and triage support tickets. Part 2 covers orchestrating tens of thousands of microVMs at once on Kubernetes.

Key facts

• Replit says it finished a complete rewrite of its sandbox engine, replacing Linux containers that share the host kernel with Cloud Hypervisor microVMs, each with its own guest kernel and minimal runc containers inside.
• The rebuild began in November 2025, was in internal use by February, and Replit says it migrated hundreds of millions of projects without data loss.
• The guest kernel is built from tinyconfig with Bluetooth, wireless, USB and display drivers omitted and module loading disabled; the VMM runs unprivileged with no Linux capabilities.
• Replit audited 6,211 Linux-CNA CVEs (June 1 to November 4, 2026) and says it avoided 5,969 (96.1%) through upstream fixes or excluded code; 4,375 (70.4%) were fixed before disclosure.
• A per-sandbox eBPF and LSM security monitor can be hot-reloaded across all production sandboxes in under 15 minutes, and egress rules are enforced on the host where the guest cannot disable them.

Why it matters

Agents now run real code, hold credentials and touch real systems, so the boundary around the environment they work in is a core security question. Replit's post argues that a boundary built on a shared kernel is too weak when Linux privilege-escalation bugs are surfacing faster, and that hardware-assisted virtualization moves the line an attacker must cross. It is a detailed first-party account of a large production migration rather than a product pitch for a new sandbox startup, and it names concrete design choices: Cloud Hypervisor over alternatives, runc containers inside the VM, a tinyconfig guest kernel, host-side egress enforcement.

Who it affects

Replit's users and the agents building applications on its platform, whose projects were migrated to the new engine. Customers of Bring Your Own Cloud, which runs Replit inside their AWS, Google Cloud or Azure environments, are named as a reason for the portability work. Teams building their own agent sandboxes can read it as a worked example of the trade-offs, such as skipping one microVM per component because the overhead was not worth it.

How to use it

This is an engineering write-up, not a release to adopt. The practical takeaways are the design patterns Replit describes: pair a microVM boundary with role-specific container permissions inside the guest; build a minimal guest kernel; keep egress policy, DNS filtering and bandwidth limits on the host side; and use credential brokers so workloads never hold upstream API keys. Replit also says the separate guest kernel lets users run Docker inside a sandbox. Part 2 of the series covers Kubernetes orchestration of tens of thousands of microVMs.

How solid is it

It is a first-party engineering post from Replit, so every figure is self-reported. The CVE audit gives its window, sources (CVEProject and kernel.org) and counts, but the breakdown is incomplete: 4,375 fixed before disclosure plus 676 excluded by configuration is 5,051, short of the 5,969 avoided, and the post as available does not explain the gap. The "at least 15" LPE figure is a floor for avoided CVEs described by the Linux CNA or Red Hat as enabling or potentially enabling LPE. No performance numbers such as boot time, snapshot restore time or overhead are given.

Risks and caveats

Replit itself notes that not every kernel CVE is exploitable in every configuration. A microVM boundary adds protection but does not remove risk: the post says the virtualization boundary does not make every process inside it equally trusted, which is why it layers namespaces, seccomp and capabilities by role. The post does not say that any Replit sandbox was compromised or escaped, nor that the previous container runtime suffered a breach. It also does not give the cost of the migration or of microVMs versus containers. The avoided-CVE share reflects Replit's own kernel build and configuration, not a general property of microVMs.

“With microVMs, compromising a sandbox’s guest kernel does not by itself compromise the host kernel. An attacker still has to cross the virtualization boundary.”

— Replit engineering post