# Isolation depth and tenancy

Lesson 1 of [Security review of an agent sandbox provider](https://agentsandboxes.fyi/academy/review-agent-sandbox-security.md), 18 minutes.

For code from many users, one wall is not enough. Ask what each layer is, and what happens if one layer fails.

## Layers to ask about

- **The main boundary**: a guest kernel in a VM or microVM, or an application kernel such as gVisor. This layer keeps the code away from the host kernel.
- **System call filters**: seccomp lets a process limit the system calls that it can make.
- **Namespaces**: they give a process its own view of resources such as process IDs, mounts and the network.
- **Control groups (cgroups)**: they limit and count the CPU, memory and other resources that a group of processes uses.

The Firecracker documentation shows this pattern. Its jailer sets up cgroups, namespaces and a chroot, and drops privileges, before it starts Firecracker. Firecracker also applies seccomp filters to limit its own system calls. These layers are a second line of defence if the virtualisation boundary fails.

## Questions for the vendor

- Which boundary separates the code of one customer from another? Is it the same on every plan?
- What runs around that boundary: seccomp, namespaces, cgroups, an unprivileged user?
- How fast do you patch the host kernel, the hypervisor or the application kernel after a security fix?
- Do two customers ever share a VM, a container or one application kernel instance?

## Tenancy rules

- Never share one sandbox between customers.
- Do not reuse a sandbox for a second customer. Create a new one.
- NIST SP 800-190 advises that you group containers with the same purpose, sensitivity and threat posture on one host kernel. If a provider uses containers on a shared kernel, ask how it keeps tenants of different sensitivity apart.

## Check the claim against the docs

The isolation field on a listing records what the vendor states. If a provider offers more than one type, find out which type your plan and region use. Get the answer in writing.

## Sources

- Firecracker documentation: design, jailer and seccomp, firecracker-microvm.github.io (checked 2026-11-04)
- gVisor documentation, gvisor.dev (checked 2026-11-04)
- Linux man pages: seccomp(2), namespaces(7) and cgroups(7)
- NIST SP 800-190, Application Container Security Guide

Also on the [web page](https://agentsandboxes.fyi/academy/review-agent-sandbox-security/isolation-depth-and-tenancy).