AWS Nitro Sandboxes: Hardware-enforced workload isolation on Amazon EKS

This article announces AWS Nitro Sandboxes for Amazon EKS, which provides hardware-enforced security isolation for Kubernetes pods by running each pod in its own lightweight virtual machine.

• Each sandboxed pod runs in its own VM with dedicated OS kernel, isolated from host and neighboring pods via AWS Nitro System hardware
• Isolated mode protects host and neighbors from container escapes; confidential mode adds cryptographic attestation for untrusted operators
• Enable with single line change: add runtimeClassName: isolated-sandbox to pod spec on EKS Auto Mode
• Supports AI agents, multi-tenant SaaS, regulated workloads, and CI/CD with hardware-backed security boundaries
• Resource throttles prevent noisy neighbors; works with existing Kubernetes tools, IAM, storage, and networking
• Available across all AWS Commercial Regions on Nitro-enabled instance families

Nitro Sandboxes eliminates the trade-off between security and efficiency by packing multiple isolated pods onto single nodes with hardware-enforced resource boundaries.