Runtime puts a hypervisor boundary around every sandbox. You pay only for the CPU the sandbox actually uses. The rate is $0.025 per active vCPU-hour, plus $0.0075 per reserved GiB-hour of memory. There is no plan fee (pricing). Each sandbox is a Firecracker microVM on KVM, which is the hypervisor in the Linux kernel.
What does a hypervisor do?
A hypervisor lets several operating systems share one physical machine. Each operating system behaves as if it has a machine of its own. The hypervisor uses the processor's virtualization extensions (Intel VT or AMD-V on x86). Guest instructions run directly on the real CPU. When a guest touches something it must not reach directly, such as a device or another guest's memory, the hypervisor intervenes.
On Linux, the hypervisor role is usually split into two parts:
- The kernel part. KVM is "a full virtualization solution for Linux on x86 hardware containing virtualization extensions", shipped as kernel modules. It owns the vCPUs and the guest memory mappings.
- The user-space part. A virtual machine monitor, such as QEMU or Firecracker, asks KVM for a VM. It then emulates the devices that the guest sees.
QEMU's documentation names the hypervisors it can run on: "KVM, Xen or Hypervisor.Framework". Cloud Hypervisor runs on KVM and on Microsoft's MSHV.
Hypervisor, VMM and emulator compared
| Term | What it is | Example |
|---|---|---|
| Hypervisor | Runs guests on virtualization hardware | KVM, Xen, Hyper-V (MSHV) |
| VMM | User-space program that drives the hypervisor | Firecracker, Cloud Hypervisor |
| Emulator | Imitates a CPU in software, no hardware help | QEMU user mode, which "always" emulates the CPU |
| Container | Host processes fenced by the host kernel | Docker, which shares the kernel |
In common usage, "hypervisor" often refers to the whole stack, which is KVM plus its monitor. For example, Cloud Hypervisor is a VMM, and its name includes "hypervisor".
Why a hypervisor matters for AI agent sandboxes
An agent installs packages and runs code that a model wrote. A prompt injection may steer that agent. Under a hypervisor, this code gets its own guest kernel. To reach the host, an attacker must break the guest kernel, then the hypervisor and its monitor. In a container, the route is one bug in the shared kernel. That is the usual path of a container escape. Docker's own documentation states that containers share the host's kernel, and that a VM has its own kernel.
How Runtime relates to it
Runtime operates the hypervisor hosts. These are dedicated servers that run one Firecracker microVM per sandbox. You never configure the hypervisor. Inside the guest, you are root. Root still cannot change network rules, CPU, memory, leases or billing. The host enforces all of these (security).
Related: KVM, microVM, Docker vs virtual machine, Cloud Hypervisor vs Firecracker.
Sources
Checked 25 October 2026.
Facts on this page were checked on 25 October 2026.