AWS launches Nitro Sandboxes: a separate hardware-isolated VM per EKS pod and ECS task at no extra fee
AWS made Nitro Sandboxes generally available on November 9, 2026: each EKS pod, ECS task or lightweight EC2 VM can get its own hardware-isolated VM. No fee beyond EC2 capacity.
According to shattered.io, AWS announced Nitro Sandboxes on November 9, 2026, and updated the launch post on November 10. Each Amazon EKS pod, Amazon ECS task and lightweight Amazon EC2 virtual machine can get its own hardware-isolated VM. AWS describes the feature as generally available from day one, with no trial tag and no waitlist, and says it runs in all commercial Regions on most Nitro-based instance types. shattered.io
shattered.ioshattered.ioOpen source ↗
Each sandbox is a lightweight VM managed by the Nitro Hypervisor, with its own operating system and kernel. The boundary between neighbors is enforced by hardware rather than by Linux namespaces. AWS charges no additional fee for the feature; customers pay for the EC2 capacity underneath.
How it works on EKS, ECS and EC2
On EKS, a pod opts in through a Kubernetes runtime class named isolated-sandbox. On EKS Auto Mode, AWS includes the runtime classes by default and provisions sandbox-capable nodes on demand, so enabling isolation takes one line in the pod spec. The EKS implementation requires Kubernetes 1.36 or later.
AWS says Pod Identity, the VPC CNI plugin, EBS, EFS, S3 and CloudWatch keep working inside a sandbox, and existing container images need no changes. A full compatibility matrix has not been published yet.
AWS documents two EKS modes. Isolated mode provides the hardware VM boundary. Confidential mode is optional and adds encrypted memory and cryptographic attestation. AWS has not said how much extra cost or startup delay confidential mode adds.
For ECS, AWS describes enabling the feature as a one-line change, after which each task runs in its own lightweight VM. The launch material does not state an ECS version requirement or a separate ECS price. On EC2, customers run lightweight VMs directly and choose their own AMI, orchestration layer and virtual machine monitor. AWS says Amazon Linux and Firecracker are supported natively at launch. shattered.io
shattered.ioshattered.ioOpen source ↗
Why a separate kernel matters
A standard container shares the host kernel with every other container on the node. With a sandbox, a kernel-level escape lands inside the VM instead of on the host. AWS positions the feature for multi-tenant containers and for untrusted automation or agents that run code nobody reviewed.
Nitro Sandboxes is separate from AWS Nitro Enclaves, an older capability for isolated compute environments inside an EC2 instance. It was not renamed or replaced. Amazon Linux 2 reached end of life on June 30, 2026, and AWS release notes recommend migrating to Amazon Linux 2023.
