What is vsock?

vsock (AF_VSOCK) is a Linux socket family for talking between a virtual machine and its host, addressed by a context ID and a port.

Runtime keeps the guest-to-host plumbing on its side: you reach a sandbox with the SDK, runtime sandbox ssh or runtime sandbox port-forward, and nothing on the internet can connect in unless you open a way (the network). Each sandbox is a Firecracker microVM, and a new one answered its first Python command 351 ms after the create request at the median on 24 September 2026 (speed).

How does vsock work?

The man page says the family "is used by guest agents and hypervisor services that need a communications channel that is independent of virtual machine network configuration." Programs use the ordinary socket calls with the AF_VSOCK address family. An address is two 32-bit numbers:

a context ID (CID), which names the endpoint: the host or one VM;
a port, which names a service on that endpoint.

No IP address, route or network card is involved: a guest reaches its host at CID 2 through the vsock device alone.

Facts

Property	vsock, as `vsock(7)` states it
Address family	`AF_VSOCK`
Socket types	`SOCK_STREAM` (ordered, reliable) and `SOCK_DGRAM` (best effort)
Address	32-bit CID plus 32-bit port
Reserved CIDs	0 hypervisor, 1 local loopback (Linux 5.6), 2 host
Kernel support	VMware VMCI from Linux 3.9, KVM virtio from 4.8, Hyper-V from 4.14
virtio device ID	19, "socket device", in the virtio specification

How Firecracker implements vsock

Firecracker offers virtio-vsock as one of its five emulated devices. On the host side it does not use the kernel's vhost code. Its documentation says Firecracker "mediates communication between AF_UNIX sockets (on the host end) and AF_VSOCK sockets (on the guest end)":

The microVM is configured with a guest_cid and a uds_path, the Unix socket that backs the device.
Host to guest: a host program connects to that Unix socket and writes CONNECT <port>\n. Firecracker answers OK <port>\n and joins the stream to whatever listens on that vsock port in the guest.
Guest to host: a guest connection to port N is forwarded to a Unix socket listening at <uds_path>_N on the host.

Why vsock matters for AI agent sandboxes

A sandbox service has to run commands, move files and stream output between its control plane and each guest. Doing that over the guest's network would mean giving the guest an address the control traffic shares with the code under test. vsock is a separate, point-to-point channel between one guest and its own host, independent of whatever the guest does to its network.

How Runtime relates to it

Runtime's guides describe what the sandbox can reach, not the channel its control traffic uses. A sandbox has no network card; outbound TCP goes through a proxy on the host, and DNS is answered inside the sandbox. Ways in are the ones you open: a preview, the SSH and port-forward tunnel, or for paid accounts a custom domain, a TCP port or a WireGuard tunnel.

Sources

Checked 25 September 2026.

Facts on this page were checked on 25 September 2026.