--- title: What everyone gets wrong about building sandboxes description: Inngest is launching Sandboxes, a built-in primitive for running agent code without a separate vendor or dashboard. The team rejected both Kubernetes with... canonical: https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What everyone gets wrong about building sandboxes | daily.dev og:description: Inngest is launching Sandboxes, a built-in primitive for running agent code without a separate vendor or dashboard. The team rejected both Kubernetes with... og:url: https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5 og:image: https://api.daily.dev/og/posts/dx06jNwT5.png og:image:alt: What everyone gets wrong about building sandboxes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What everyone gets wrong about building sandboxes **[Inngest Blog](https://daily.dev/sources/inngest)** · 7 min read · 0 upvotes · 0 comments ## Summary Inngest is launching Sandboxes, a built-in primitive for running agent code without a separate vendor or dashboard. The team rejected both Kubernetes with gVisor and plain Firecracker, building instead on cloud-hypervisor for CPU, memory and device hotplug, virtio-fs, and snapshot/restore. Warm pools of snapshotted VMs boot before knowing the workload, then get hotplugged with network, CPU and filesystem mounts on assignment. Networking runs as custom eBPF programs with VXLAN isolation instead of TAP-and-bridge, and storage uses ZFS for fast copy-on-write snapshots, targeting sub-250ms boots and a future of rewindable 'durable sandboxes'. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why isn't Firecracker enough for building fast, full-featured sandboxes? Firecracker lacks CPU hotplug, virtio-fs for sharing a host filesystem, device passthrough (no VFIO for GPUs or NVMe), and only has network hotplug in developer preview. Firecracker is intentionally minimal, ideal for short-lived Lambda functions, but those missing features block building persistent, resizable, richly networked sandbox VMs. _Evaluating hypervisors for agent sandboxes? Track these infra trade-offs on daily.dev._ ### Why are TAP interfaces a bottleneck when booting many VMs per second? Creating and configuring each TAP interface takes kernel-wide locks, so they're created one at a time. Bringing up 1,000 sandboxes in a second on one machine causes them to queue behind each other, making warm pool refills the bottleneck. An eBPF-based datapath with VXLAN tagging at line rate avoids this per-VM bridge and interface overhead. _Building high-throughput sandbox infrastructure? Follow networking deep dives like this on daily.dev._ ### What hypervisor does Inngest use for its sandbox VMs and why? Inngest uses cloud-hypervisor, built from the same rust-vmm components as Firecracker but with the extra features sandboxes need: CPU, memory, and device hotplug, virtio-fs, VFIO passthrough, and snapshot/restore. This lets a generic pre-warmed VM be hotplugged into a specific customer's VPC, CPU shape, and filesystem on assignment, avoiding a separate warm pool per customer configuration. _Comparing microVM options for your own sandbox or agent runtime? Keep up with posts like this on daily.dev._ ## Similar posts on daily.dev - [Sandboxes are a durability problem](https://daily.dev/posts/sandboxes-are-a-durability-problem-usenqd477) · Inngest Blog · 1 upvotes · 0 comments - [Every dev should know about AI sandboxes](https://daily.dev/posts/every-dev-should-know-about-ai-sandboxes-cfpxzueug) · Engineer’s Codex · 1 upvotes · 0 comments - [Your Container Is Not a Sandbox](https://daily.dev/posts/your-container-is-not-a-sandbox-dkskd3kl8) · Lobsters · 26 upvotes · 1 comments - [Why MicroVMs: The Architecture Behind Docker Sandboxes](https://daily.dev/posts/why-microvms-the-architecture-behind-docker-sandboxes-qzo1tfme1) · Docker · 10 upvotes · 0 comments - [Google Cloud: A Deep Dive into GKE Sandbox for Agents](https://daily.dev/posts/google-cloud-a-deep-dive-into-gke-sandbox-for-agents-keoxzofzg) · The New Stack · 3 upvotes · 0 comments --- Tags: [#inngest](https://daily.dev/tags/inngest), [#firecracker](https://daily.dev/tags/firecracker) [View this post on daily.dev](https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What everyone gets wrong about building sandboxes","url":"https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5"},"datePublished":"2026-10-21T22:21:43.569Z","dateModified":"2026-10-21T23:25:46.602Z","description":"Inngest is launching Sandboxes, a built-in primitive for running agent code without a separate vendor or dashboard. The team rejected both Kubernetes with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f42b9fbf01449cb3f76d6e07fa28a4d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6f42b9fbf01449cb3f76d6e07fa28a4d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Inngest Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Inngest Blog","logo":"https://media.daily.dev/image/upload/s--ieZKUa5y--/c_limit,w_256/f_auto,q_auto/v1789329423/logos/inngest?_a=BAMAMicg0","url":"https://daily.dev/sources/inngest"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"inngest,firecracker","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Inngest Blog","item":"https://daily.dev/sources/inngest"},{"@type":"ListItem","position":3,"name":"What everyone gets wrong about building sandboxes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-everyone-gets-wrong-about-building-sandboxes-dx06jnwt5#faq","mainEntity":[{"@type":"Question","name":"Why isn't Firecracker enough for building fast, full-featured sandboxes?","acceptedAnswer":{"@type":"Answer","text":"Firecracker lacks CPU hotplug, virtio-fs for sharing a host filesystem, device passthrough (no VFIO for GPUs or NVMe), and only has network hotplug in developer preview. Firecracker is intentionally minimal, ideal for short-lived Lambda functions, but those missing features block building persistent, resizable, richly networked sandbox VMs. Evaluating hypervisors for agent sandboxes? Track these infra trade-offs on daily.dev."}},{"@type":"Question","name":"Why are TAP interfaces a bottleneck when booting many VMs per second?","acceptedAnswer":{"@type":"Answer","text":"Creating and configuring each TAP interface takes kernel-wide locks, so they're created one at a time. Bringing up 1,000 sandboxes in a second on one machine causes them to queue behind each other, making warm pool refills the bottleneck. An eBPF-based datapath with VXLAN tagging at line rate avoids this per-VM bridge and interface overhead. Building high-throughput sandbox infrastructure? Follow networking deep dives like this on daily.dev."}},{"@type":"Question","name":"What hypervisor does Inngest use for its sandbox VMs and why?","acceptedAnswer":{"@type":"Answer","text":"Inngest uses cloud-hypervisor, built from the same rust-vmm components as Firecracker but with the extra features sandboxes need: CPU, memory, and device hotplug, virtio-fs, VFIO passthrough, and snapshot/restore. This lets a generic pre-warmed VM be hotplugged into a specific customer's VPC, CPU shape, and filesystem on assignment, avoiding a separate warm pool per customer configuration. Comparing microVM options for your own sandbox or agent runtime? Keep up with posts like this on daily.dev."}}]} ```