Replit 用自研内核沙箱避开 96% 的 Linux 零日漏洞
Replit 把沙箱改成 microVM，每个沙箱独立内核，避开 96% 的 Linux 零日漏洞，还写了架构细节，做 agent 平台的值得看看。
Replit 重建了其沙箱引擎，将架构迁移到 microVM，每个沙箱拥有独立的 Linux 内核。官方表示借助这套自研内核构建，可以避开 96% 的 Linux 零日漏洞。设计中包括最小化 guest 内核、在 guest 之外执行的网络控制，以及让工作负载无需持有可复用凭据就能发起授权请求的 credential broker。官方博客 frontier.replit.com 公开了这套架构背后的决策细节。
There are so many Linux zero-day vulnerabilities these days, but on Replit we’re able to avoid 96% of them with our custom Kernel build. Read about our new sandbox design. Replit ⠕ @Replit AI agents need room to work and boundaries on what they can reach. We rebuilt Replit’s sandbox engine around microVMs, giving each sandbox its own Linux kernel. We break down the decisions behind that architecture: a minimal guest kernel, network controls enforced outside the guest, and credential brokers that let workloads make authorized requests without receiving reusable account credentials. frontier.replit.com/sandbox-engine… 🔗 View Quoted Tweet 💬 20 🔄 5 ❤️ 71 👀 10484 📊 20 ⚡
