Runtime's VMM is Firecracker. It runs one process per sandbox, and you never run it yourself. A sandbox that waits on a model costs $0.03125 an hour at 2 vCPU and 4 GiB (pricing).
What does a VMM do?
KVM lets Linux run guest code on the processor's virtualization extensions. It leaves most of the machine to user space. The VMM fills that gap. It:
- Opens
/dev/kvm, creates a VM and its vCPUs. - Maps the guest's memory and loads a kernel into it.
- Emulates the devices the guest can see: disks, network cards, consoles.
- Runs a loop per vCPU that calls
KVM_RUNand handles each exit, such as a write to a device register. - Offers a control interface for starting, pausing and snapshotting.
Firecracker's design document shows this structure. "Each Firecracker process
encapsulates one and only one microVM." It has three kinds of thread: an API
thread for the control plane, a VMM thread that emulates the virtio net, block
and vsock devices in one event loop, and one thread per vCPU that runs
KVM_RUN.
Common VMMs compared
| VMM | Runs on | Stated focus |
|---|---|---|
| Firecracker | KVM | Secure, multi-tenant container and function services |
| Cloud Hypervisor | KVM, MSHV | "Modern, cloud workloads, with minimal hardware emulation" |
| QEMU | KVM, Xen, Hypervisor.Framework, or pure emulation | "A generic and open source machine emulator and virtualizer" |
Firecracker and Cloud Hypervisor are both written in Rust.
Why the VMM matters for AI agent sandboxes
The VMM is the host code that a hostile guest talks to most. Every device it emulates parses input that the guest controls. A VMM with fewer devices gives an attacker less code to probe. This is why Firecracker "excludes unnecessary devices and guest-facing functionality to reduce the memory footprint and attack surface area of each microVM." Firecracker also assumes that guest vCPUs run malicious code from the moment they start. It confines itself with seccomp filters by default (seccomp).
A smaller monitor also starts faster. This matters when an agent needs a fresh machine for every task.
How Runtime relates to it
Each Runtime sandbox is a Firecracker microVM with its own Linux kernel and disk. It runs Ubuntu 24.04. Runtime runs the monitors on its own dedicated servers. It keeps host credentials and control sockets away from customers (security). Custom image builds also run in a Firecracker guest of their own (images).
Related: Firecracker, KVM, hypervisor, Cloud Hypervisor vs Firecracker, QEMU vs Firecracker.
Sources
Checked 25 October 2026.
Facts on this page were checked on 25 October 2026.