A new isolation option for shared instances
AWS announced Nitro Sandboxes on November 9 for EKS pods, ECS tasks and virtual machines on EC2, including workloads that run AI-generated code. The lightweight virtual machines use the Nitro Hypervisor rather than relying solely on a container’s operating-system boundary.
Availability does not mean every EC2 instance
AWS says the feature is available across commercial regions without an additional feature charge. Its EC2 guide limits support to instance types that can run Nitro Enclaves, with exceptions listed by family. Underlying instance and other service usage should not be mistaken for free computing.
The two modes provide different protection
In the default confidential mode, AWS says the parent cannot read the sandbox’s memory and the workload can provide cryptographic attestation. Direct mode retains parent access to memory and does not provide that attestation. Teams should check which mode matches their trust requirements.
Read the limits before sizing a deployment
The guide says sandbox memory is reserved rather than overcommitted, GPU passthrough is currently unavailable, and changing CPU or memory allocation requires recreating the sandbox. Parent-instance networking resources also remain shared and need limits.
Those constraints matter when estimating capacity or handling untrusted workloads. This launch report is not an independent security audit, performance benchmark or guarantee that every workload can migrate unchanged.
