Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 for hardware isolated pods, tasks and VMs

AWS Nitro Sandboxes Release

AWS Nitro Sandboxes are now available as lightweight VMs managed by the Nitro Hypervisor. These can be used for Amazon EKS pods, Amazon ECS tasks, or lightweight Virtual Machines (VMs) including AI agents, all running in their own hardware-isolated virtual machine powered by the AWS Nitro System. Each workload gets the isolation boundary of a Nitro isolated virtual machine, allowing you to safely run untrusted, multi-tenant, or regulated workloads within the resources of a single instance.

Nitro Sandboxes run on your EC2 instances with near-native EC2 performance and inherits Nitro-hypervisor isolation. You can validate your workloads through cryptographic attestation, ensuring secrets are released only to Nitro Sandboxes that have proven their integrity. With Nitro Sandboxes, you can securely execute LLM-generated code in an isolated environment, improving utilization and lowering compute costs by sharing a single EC2 instance across multiple workloads.

What to do

• Enable EKS pods or ECS tasks to run on Nitro Sandboxes with a one-line change.
• Run Nitro Sandboxes directly on EC2 with your own AMI, orchestration, and VMMs.
• Use Amazon Linux and Firecracker, which are natively supported, or use patches for other options.

AWS Nitro Sandboxes are available today on most nitro-based EC2 instances, in all commercial regions worldwide, at no additional charge.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.