Runtime keeps the guest-to-host plumbing on its side. You reach a sandbox with
the SDK, runtime sandboxes ssh or runtime sandboxes port-forward. Nothing on
the internet can connect in unless you open a way (the
network). Each sandbox is a Firecracker
microVM.
How does vsock work?
The man page says the family "is used by guest agents and hypervisor services
that need a communications channel that is independent of virtual machine
network configuration." Programs use the ordinary socket calls with the
AF_VSOCK address family. An address has two 32-bit numbers:
- a context ID (CID), which names the endpoint: the host or one VM;
- a port, which names a service on that endpoint.
No IP address, route or network card is involved. A guest reaches its host at CID 2 through the vsock device alone.
Facts
| Property | vsock, as vsock(7) states it |
|---|---|
| Address family | AF_VSOCK |
| Socket types | SOCK_STREAM (ordered, reliable) and SOCK_DGRAM (best effort) |
| Address | 32-bit CID plus 32-bit port |
| Reserved CIDs | 0 hypervisor, 1 local loopback (Linux 5.6), 2 host |
| Kernel support | VMware VMCI from Linux 3.9, KVM virtio from 4.8, Hyper-V from 4.14 |
| virtio device ID | 19, "socket device", in the virtio specification |
How Firecracker implements vsock
Firecracker offers virtio-vsock as one of its five emulated devices. On the host side, it does not use the kernel's vhost code. Its documentation says that Firecracker "mediates communication between AF_UNIX sockets (on the host end) and AF_VSOCK sockets (on the guest end)":
- The microVM is configured with a
guest_cidand auds_path, which is the Unix socket that backs the device. - Host to guest: a host program connects to that Unix socket and writes
CONNECT <port>\n. Firecracker answersOK <host-port>\n, naming the port it assigned to the host end, and joins the stream to whatever listens on that vsock port in the guest. - Guest to host: a guest connection to port N is forwarded to a Unix socket
that listens at
<uds_path>_Non the host.
Why vsock matters for AI agent sandboxes
A sandbox service must run commands, move files and stream output between its control plane and each guest. Doing that over the guest's network would give the guest an address that the control traffic shares with the code under test. vsock is a separate, point-to-point channel between one guest and its own host. It does not depend on anything the guest does to its network.
How Runtime relates to it
Runtime's guides describe what the sandbox can reach. They do not describe the channel that its control traffic uses. A sandbox has no network card. Outbound TCP goes through a proxy on the host, and DNS is resolved inside the sandbox. The ways in are the ones you open: a preview, the SSH and port-forward tunnel, or, for paid accounts, a custom domain, a TCP port or a WireGuard tunnel.
Related: virtio, Firecracker, egress control, turn off sandbox internet.
Sources
Checked 25 October 2026.
Facts on this page were checked on 25 October 2026.