The QEMU VM Tier

The QEMU VM tier

By default a sandbox is a hardened container. Pass "driver": "qemu" at instance create and the same sandbox boots as a real virtual machine — the agent's kernel becomes the guest kernel, so a kernel exploit lands in a disposable VM instead of on your host.

Build the VM image once

make sandbox-vm

This converts the sandbox container image into a bootable guest disk at build time (mke2fs -d — no privileges, no loop mounts). Because the disk is derived from the container image, the VM runs byte-for-byte the same agentd, desktop and supervisord config as the container tier and cannot drift from it.

Create a VM instance

curl -X POST http://localhost:8081/api/instances \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"vm-bot","tier":"standard","driver":"qemu","shell_access":true}'

(API-only for now — the console's launch dialog doesn't offer the driver field yet.)

What to expect

• With /dev/kvm (bare-metal Linux): hardware-accelerated, boots fast.
• Without it (Docker Desktop, most CI): TCG software emulation — same guest, several minutes to boot. The runner logs which mode it chose, and the health check budget already accounts for the slow path.
• The orchestrator's addressing, health checks and desktop streaming are identical for both drivers — QEMU forwards agentd and both VNC ports onto the runner's own address.
• Each boot runs on a fresh qcow2 overlay; the base disk stays pristine.

Egress on the VM tier

Egress policies are enforced in the runner's network namespace, which every guest connection must traverse and which nothing inside the guest can reach — an agent with root in the guest can flush its own tables all day and never touch the policy. Details and caveats: Egress-Policies.

Boundaries, stated plainly

• No GPU on the VM tier. vfio-pci passthrough needs IOMMU hardware the project's CI can't exercise, so it stays roadmap rather than shipping untested.
• The container driver remains the default and the shipped security model — see docs/SECURITY.md. The VM driver is the stronger boundary for workloads that warrant the boot cost.