# What is a bare-metal server?

A bare-metal server is a physical machine rented whole, with no provider hypervisor between your software and the hardware.

**Runtime runs every sandbox as a Firecracker microVM on dedicated servers it
operates itself, so each one gets its own kernel without a second layer of
virtualization underneath.** A new sandbox ran its first Python command
221 ms after the create request at the median on Runtime's servers on 28 September 2026
([speed](/docs/speed)).

## Bare metal against a virtual machine

| Question              | Bare-metal server                               | Virtual machine                       |
| --------------------- | ----------------------------------------------- | ------------------------------------- |
| Who owns the hardware | You, for the rental period                      | Shared; the provider slices it        |
| Hypervisor            | Yours to install, or none                       | The provider's                        |
| Hardware features     | All of them: `/dev/kvm`, performance counters   | Only what the provider passes through |
| Start time            | Minutes to hours, when a machine is provisioned | Seconds to minutes                    |
| Billing               | The whole machine, busy or not                  | The slice, usually by the second      |

## Why sandbox providers care

A microVM needs hardware virtualization, which Linux exposes as KVM. Nested
inside another provider's VM, that is often missing or slow. Firecracker's own
getting-started guide is direct about it: "EC2 only supports KVM on `.metal`
instance types", and the project runs its tests on those. So a sandbox service
built on microVMs either rents bare metal or owns servers.

Owning the servers also sets the price floor. A provider reselling another
cloud's VMs pays that cloud's margin first; one running its own hardware can
bill the CPU a sandbox uses rather than the vCPUs it holds, which is how
Runtime charges $0.025 per active vCPU-hour ([pricing](/docs/pricing)).

## What you get on Runtime

You do not rent the machine. You get a slice of it with its own kernel,
enforced on the host: CPU, memory, disk and network rules are applied outside
the guest ([security](/docs/security)). A paid sandbox takes up to
16 vCPUs and 64 GiB, pauses with its memory kept, and costs
$0.03125 an hour at 2 vCPUs and 4 GiB while it waits.

## Related

- [What is KVM?](/glossary/kvm)
- [What is a microVM?](/glossary/microvm)
- [What is a hypervisor?](/glossary/hypervisor)
- [What is infrastructure as a service?](/glossary/infrastructure-as-a-service)

## Sources

Checked 27 September 2026.

- [Firecracker getting started](https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md)
- [Runtime security](/docs/security)