AWS launches Nitro Sandboxes: a hardware-isolated VM per EKS pod, ECS task or lightweight EC2 VM, pitched at running untrusted and agent-generated code
- Security relevance: shared-kernel containers have been the weak boundary for multi-tenant and agent code-execution platforms; this gives a VM boundary without a dedicated instance per workload.
- Caveat from AWS's docs: the isolation is a security boundary, not a performance reservation, and supported instance types are limited.
Sources: AWS What's New: Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 (Nov 9, 2026) · Amazon EKS User Guide: Sandboxing with isolated and confidential pods