What is a virtual machine monitor (VMM)?

A virtual machine monitor (VMM) is the program that creates a VM on a hypervisor, emulates its devices and runs its virtual CPUs.

Runtime's VMM is Firecracker, one process per sandbox, and you never run it yourself. A sandbox is ready for its first Python command 351 ms after the create call at the median (24 September 2026, speed), and one that waits on a model costs $0.03125 an hour at 2 vCPU and 4 GiB (pricing).

What does a VMM do?

KVM gives Linux the ability to run guest code on the processor's virtualization extensions, but it leaves most of the machine to user space. The VMM fills that gap. It:

Opens /dev/kvm, creates a VM and its vCPUs.
Maps the guest's memory and loads a kernel into it.
Emulates the devices the guest can see: disks, network cards, consoles.
Runs a loop per vCPU that calls KVM_RUN and handles each exit, such as a write to a device register.
Offers a control interface for starting, pausing and snapshotting.

Firecracker's design document shows this shape. "Each Firecracker process encapsulates one and only one microVM", with three kinds of thread: an API thread for the control plane, a VMM thread that emulates the virtio net, block and vsock devices in one event loop, and one thread per vCPU running KVM_RUN.

Common VMMs compared

VMM	Runs on	Stated focus
Firecracker	KVM	Secure, multi-tenant container and function services
Cloud Hypervisor	KVM, MSHV	"Modern, cloud workloads, with minimal hardware emulation"
QEMU	KVM, Xen, Hypervisor.Framework, or pure emulation	"A generic and open source machine emulator and virtualizer"

Firecracker and Cloud Hypervisor are both written in Rust.

Why the VMM matters for AI agent sandboxes

The VMM is the host code a hostile guest talks to most. Every device it emulates is parsing input the guest controls. A VMM with fewer devices has less code for an attacker to probe, which is why Firecracker "excludes unnecessary devices and guest-facing functionality to reduce the memory footprint and attack surface area of each microVM." It also assumes guest vCPUs run malicious code from the moment they start, and confines itself with seccomp filters by default (seccomp).

A smaller monitor also starts faster, which matters when an agent wants a fresh machine for every task.

How Runtime relates to it

Each Runtime sandbox is a Firecracker microVM with its own Linux kernel and disk, running Ubuntu 24.04. Runtime runs the monitors on its own dedicated servers and keeps host credentials and control sockets away from customers (security). Custom image builds also run in a Firecracker guest of their own (images).

Sources

Checked 25 September 2026.

Facts on this page were checked on 25 September 2026.