Replit says it has completed a sandbox-engine rebuild around microVMs, giving each sandbox a separate Linux kernel. Its previous container runtime shared the host kernel. In an engineering account retrieved on November 7, 2026, the company says the system has been running in production for a few months. The exact rollout completion date is unspecified. For developers evaluating coding-agent environments, the change is a different containment boundary: compromising a guest kernel does not by itself compromise the host kernel, according to Replit.
Replit began the rebuild in November 2025, started using it internally by February and spent the following months hardening and deploying it. The account describes a completed rollout. This article examines Replit's documented architecture; we did not test its isolation or reproduce its performance figures.
Containers stay inside the virtual machine
Replit chose Cloud Hypervisor as its virtual machine monitor. Its design description says KVM separates each sandbox from the host and other customers' workloads, while containers continue to separate processes inside the guest. Those containers retain separate namespaces, resource limits and role-specific permissions.
That arrangement lets Replit expose tools such as Docker inside a sandbox without granting those privileges on the physical host. The virtual machine monitor itself runs under an unprivileged identity with no Linux capabilities, according to the company.
Replit also builds a reduced guest kernel, leaving out hardware subsystems such as Bluetooth and USB. Required drivers are built in, and guest initialization disables module loading. Excluding those subsystems reduces the kernel code present in the guest. These design choices do not establish that the remaining virtualization boundary is free of exploitable flaws.
Network permission is a separate control
For sandboxes with an egress policy, Replit says enforcement runs outside the guest. A host-side proxy checks TLS handshake hostnames without decrypting application payloads, filters DNS and rejects traffic outside the permitted path. The guest cannot disable those host-side rules, according to Replit.
The qualification matters when evaluating an agent environment: a separate kernel describes where code executes, while an egress policy determines which network destinations it may reach. Replit's managed connectors also use brokers that attach upstream credentials after authorization, letting a workload use a connected service without receiving its account API key.
What the 500 ms figure measures
Replit reports that acquiring a sandbox takes roughly 500 ms, including attaching and mounting customer volumes and configuring supporting services in parallel. Warm pools prepare much of the work in advance, and remote block storage fetches filesystem data on demand. This is the company's workspace handoff figure, with disks mounted. We did not measure it, and the account does not establish a latency guarantee for every workload.
Replit says a follow-up will explain Kubernetes orchestration across tens of thousands of microVMs. The first account explains the isolation boundary and startup path; it does not provide independent security validation or establish latency for a reader's particular workload. Developers evaluating it should check which egress policy applies to their sandbox and whether the reported mounted-volume handoff matches the startup operation they need.