Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 for hardware isolated pods, tasks and VMs

This article announces the availability of AWS Nitro Sandboxes, lightweight VMs managed by the Nitro Hypervisor that provide hardware isolation for pods, tasks, and workloads across EKS, ECS, and EC2.

• Run EKS pods and ECS tasks in isolated Nitro VMs with one-line configuration changes
• Execute untrusted, multi-tenant, and regulated workloads safely within a single EC2 instance
• Validate workload integrity through cryptographic attestation before releasing secrets
• Securely run LLM-generated code and AI agents in isolated environments
• Improve resource utilization and lower compute costs by sharing instances across multiple workloads
• Available on most Nitro-based EC2 instances in all commercial regions at no additional charge
• Supports Amazon Linux and Firecracker natively with patches for other options

Nitro Sandboxes enable secure multi-tenant workload isolation while maintaining native AWS service integration and near-native performance.