# What is virtio?

virtio is an OASIS standard for virtual devices, such as disks and network cards, that a guest drives through shared-memory queues.

**Runtime gives every sandbox a Firecracker microVM, a monitor built around a
handful of virtio devices, and a sandbox is ready for code in about a third of
a second:** 351 ms from the create request to the first Python result at the
median, measured on 24 September 2026 ([speed](/docs/speed)).

## Why virtio exists

A virtual machine needs devices, and every guest operating system needs
drivers for them. virtio gives both sides one agreed family of virtual
devices. Its introduction says "virtual environments and guests should have a
straightforward, efficient, standard and extensible mechanism for virtual
devices, rather than boutique per-environment or per-OS mechanisms." The
devices deliberately look like ordinary hardware to the guest, so standard
driver discovery finds them.

Data moves through **virtqueues**: "rings of descriptors for both input and
output, which are neatly laid out to avoid cache effects from both driver and
device writing to the same cache lines." Feature bits, acknowledged when the
device starts, let a newer device and an older driver agree on what both
support.

## Facts

| Property          | virtio, as the OASIS specification states it                           |
| ----------------- | ---------------------------------------------------------------------- |
| Publisher         | OASIS Virtual I/O Device (VIRTIO) TC                                   |
| Latest version    | 1.3, a committee specification draft dated 6 October 2023              |
| Transport         | PCI, memory-mapped I/O (MMIO) or channel I/O                           |
| Data path         | Virtqueues of buffer descriptors                                       |
| Compatibility     | Feature bits negotiated between device and driver                      |
| Device IDs (some) | 1 network, 2 block, 3 console, 4 entropy, 5 balloon, 19 socket (vsock) |

## Which virtio devices does Firecracker use?

On Firecracker's site, "only 5 emulated devices are available": three of them
virtio (net, block and vsock), plus a serial console and a minimal keyboard
controller used only to stop the microVM. Its design document says one VMM thread emulates the virtio
network, block and vsock devices in a single event loop, backed by host TAP
devices and files, with rate limiting applied at the I/O boundary. The
[vsock](/glossary/vsock) device is the one that carries sockets between guest
and host without a network.

## Why virtio matters for AI agent sandboxes

Every emulated device is host code that parses what the guest sends it, and
in an agent sandbox the guest may be running hostile code. A small set of
purpose-built virtio devices keeps that code short. It also keeps disk and
network fast enough that an agent installing packages or cloning a repository
does not wait on emulation.

## How Runtime relates to it

Each Runtime sandbox is a Firecracker microVM with its own kernel and disk.
The guides describe the result rather than the devices: a sandbox has no
network card, and every outbound connection goes through a proxy on the host
that root inside cannot bypass
([the network](/docs/sandbox-environment#the-network)). The disk bursts to about
250 MB/s and 20,000 operations a second for up to 30 seconds, then runs at about
40 MB/s and 2,000 a second
([disk, CPU and memory](/docs/sandbox-environment#disk-cpu-and-memory)).

Related: [Firecracker](/glossary/firecracker),
[virtual machine monitor](/glossary/virtual-machine-monitor),
[QEMU vs Firecracker](/compare/qemu-vs-firecracker).

## Sources

Checked 25 September 2026.

- [Virtual I/O Device (VIRTIO) Version 1.3, OASIS](https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html)
- [VIRTIO 1.3 directory, OASIS](https://docs.oasis-open.org/virtio/virtio/v1.3/)
- [Firecracker](https://firecracker-microvm.github.io/)
- [Firecracker design](https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md)

Facts on this page were checked on 25 September 2026.