Replit has completed a full rewrite of its sandbox engine to support autonomous AI agents, migrating hundreds of millions of projects without downtime. The new system uses microVMs powered by KVM and Cloud Hypervisor for stronger isolation, replacing Docker-based sandboxes. This shift addresses growing security concerns in the AI industry, where agents have been known to access unintended systems. Replit’s solution enables persistent workspaces, high concurrency, and Bring Your Own Cloud support across AWS, Google Cloud, and Azure. The engine is already in production and will scale to tens of thousands of microVMs on Kubernetes in Part 2. The move reflects a broader industry trend, with startups like Daytona and E2B raising $59.3M in 2025 to build similar infrastructure. Replit’s decade of sandboxing experience positions it as a leader in secure, scalable agent environments.
The transition from Docker to microVMs was a deliberate rewrite, not a port, allowing rapid prototyping and innovation. Features like virtiofs, hotplug, and memory snapshots enable fast, flexible sandboxing. With NIST standards and congressional scrutiny focusing on AI isolation, Replit’s architecture sets a new benchmark for agent security and performance.
Source: Hacker News · Summarized by HeadlinesBriefing