Why the shared kernel had to go
Online coding platform Replit published "Inside Replit's New Sandbox Engine, Part 1" on its engineering blog on November 4, written by its Compute Platform team. For nearly a decade Replit ran user code in Docker containers on Google Compute Engine VMs; the containers shared the host kernel, so one exploitable kernel bug could let an attacker escape to other workloads on the same machine. The rewrite began in November 2025, was in internal use by February, and was rolled out fully over the following months. In the new engine each sandbox is a microVM isolated with KVM and Cloud Hypervisor (which shares rust-vmm components with Firecracker), and containers only separate processes inside the sandbox. Replit says it migrated hundreds of millions of projects without data loss, and having a separate kernel also lets it support Docker inside sandboxes.
A minimal kernel and a CVE tally
The guest kernel starts from tinyconfig, drops Bluetooth, wireless, USB and display drivers, and disables module loading. Replit counted 6,211 Linux kernel CVEs published from June 1 to November 4, 2026, and says it avoided 5,969 of them (96.1%): fixes for 4,375 had landed before disclosure, and 676 were excluded because the affected code is configured out. Egress rules are enforced outside the guest by a host-side proxy that filters on the hostname in the TLS handshake without decrypting traffic; managed connectors reach services such as GitHub through a credential broker, so workloads never hold account keys; and npm and pip requests pass through a registry firewall that blocks known malicious packages.
Storage and startup
Sandbox file systems sit on Replit's own remote block storage, fetched on demand, with copy-on-write making disk forks cheap. Replit notes that the vhost-user virtio-blk backend connecting to this storage was one of its first components written entirely by AI, going through five to seven iterations before settling. With warm pools and memory snapshots, acquiring a sandbox, including mounting the user's disks, takes about 500 ms. How it orchestrates tens of thousands of microVMs at once on Kubernetes is left for Part 2. The performance and security figures in the post are Replit's own and have not been audited by a third party.
via: Replit Frontier: Inside Replit's New Sandbox Engine, Part 1: The Path to MicroVMs