Security
Partly builtSome of this works today; the page says which parts.
The boundary is the host, never the guest. You have root in the VM, and an agent may run hostile code, so nothing inside a guest is trusted.
| Topic | Today | Planned |
|---|---|---|
| Tenant isolation in the API | Built and tested | |
| Snapshots encrypted per sandbox | Built and tested | |
| Delete destroys the key first | Built and tested | |
| Secrets stay out of the guest by default | Built and tested for the proxy | |
| VM isolation | One VM per sandbox | Needs host hardening |
| Firewall outside the guest | At the edge | On each host, with eBPF |
| Measured boot | On owned hosts | |
| Core scheduling between tenants | On real hosts |
Reporting a problem: quote the request_id. A disclosure address comes with a public service.