---
title: AWS launches Nitro Sandboxes: a hardware-isolated VM per EKS pod, ECS task or lightweight EC2 VM, pitched at running untrusted and agent-generated code | ctxsec
url: https://ctxsec.com/items/aws-nitro-sandboxes-hardware-isolated-eks-pods-ecs-tasks-agent-workloads
description: "AWS says each sandboxed pod or task now runs in its own lightweight VM under the Nitro Hypervisor, with its own kernel, so a container escape or kernel bug can't reach neighbors on the same instance. It's opt-in per pod (runtimeClassName isolated-sandbox or confidential-sandbox), keeps Pod Identity, VPC CNI, EBS/EFS and CloudWatch working, supports attestation so KMS releases keys only to a sandbox with the expected measurements, and is available at no extra charge on most Nitro instances in all commercial regions."
status: "official (AWS What's New and EKS User Guide, Nov 9, 2026)"
published: 2026-11-09
---

> AWS says each sandboxed pod or task now runs in its own lightweight VM under the Nitro Hypervisor, with its own kernel, so a container escape or kernel bug can't reach neighbors on the same instance. It's opt-in per pod (runtimeClassName isolated-sandbox or confidential-sandbox), keeps Pod Identity, VPC CNI, EBS/EFS and CloudWatch working, supports attestation so KMS releases keys only to a sandbox with the expected measurements, and is available at no extra charge on most Nitro instances in all commercial regions.

[← Industry News](/industry) · [markdown](/items/aws-nitro-sandboxes-hardware-isolated-eks-pods-ecs-tasks-agent-workloads.md)

official (AWS What's New and EKS User Guide, Nov 9, 2026)

2026-11-09

### AWS launches Nitro Sandboxes: a hardware-isolated VM per EKS pod, ECS task or lightweight EC2 VM, pitched at running untrusted and agent-generated code

- **Security relevance:** shared-kernel containers have been the weak boundary for multi-tenant and agent code-execution platforms; this gives a VM boundary without a dedicated instance per workload.
- **Caveat from AWS's docs:** the isolation is a security boundary, not a performance reservation, and supported instance types are limited.

Sources: [AWS What's New: Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 (Nov 9, 2026)](https://aws.amazon.com/about-aws/whats-new/2026/11/nitro-sandboxes-eks-ecs-ec2/) · [Amazon EKS User Guide: Sandboxing with isolated and confidential pods](https://docs.aws.amazon.com/eks/latest/userguide/sandboxing.html)