Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 for hardware isolated pods, tasks and VMs

AWS Nitro Sandboxes Release

AWS Nitro Sandboxes are now available as lightweight VMs managed by the Nitro Hypervisor, providing hardware-isolated virtual machines for Amazon EKS pods, Amazon ECS tasks, and lightweight Virtual Machines (VMs). This allows for the safe execution of untrusted, multi-tenant, or regulated workloads within the resources of a single instance.

Key features include:

• Isolation: Each workload gets its own isolation boundary.
• Performance: Near-native EC2 performance with Nitro-hypervisor isolation.
• Security: Validate workloads through cryptographic attestation.
• Cost Efficiency: Improve utilization and lower compute costs by sharing a single EC2 instance across multiple workloads.
• Compatibility: Fully native support for Pod Identity, VPC CNI, EBS/EFS/S3 storage, and CloudWatch.
• Customization: Run Nitro Sandboxes directly on EC2 with your own AMI, orchestration, and VMMs.
• Support: Native support for Amazon Linux and Firecracker, with patches available for other options.

What to do

• Enable Nitro Sandboxes in EKS or ECS with a one-line change.
• Run Nitro Sandboxes directly on EC2 for full control.
• Refer to the Nitro Sandboxes documentation for implementation details.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.