There are so many Linux zero-day vulnerabilities these days, but on Replit we’re able to avoid 96% of them with our custom Kernel build.
Read about our new sandbox design.
AI agents need room to work and boundaries on what they can reach.
We rebuilt Replit’s sandbox engine around microVMs, giving each sandbox its own Linux kernel.
We break down the decisions behind that architecture: a minimal guest kernel, network controls enforced outside the guest, and credential brokers that let workloads make authorized requests without receiving reusable account credentials.
Show more
