Replit rebuilds sandbox engine amid 6,211 kernel advisories

The author argues that building or buying sandbox infrastructure for coding agents requires significant hidden labor to triage and patch Linux kernel vulnerabilities. Although moving from Docker to microVMs provides stronger isolation, maintaining custom guest kernels and reviewing thousands of security advisories demands dedicated engineering time that many companies underestimate. The article advises teams to enforce egress rules, keep API keys outside the sandbox, and carefully evaluate isolation vendors on fix paths and incident records. Open article →