---
title: "Sandbox escapes · Ataris"
description: "An isolation breakout is the one incident a compute provider can't survive quietly. Ataris puts tripwires around every VMM and sandbox on the host, so you'd know if one happened."
canonical: "https://ataris.dev/use-cases/sandbox-escapes"
last-updated: 2026-11-02
---
# Know if anyone broke out of the sandbox.

An isolation breakout is the one incident a compute provider can't survive quietly. Ataris puts tripwires around every VMM and sandbox on the host, so you'd know if one happened.

## Most providers couldn't tell if anything escaped.

runc, Firecracker, gVisor, Kata, and KVM all have isolation advisories in their history. When the next one lands, the question is whether anyone used it on your fleet.

### 1. Expect: Know the VMM's normal.

A VMM or sandbox process does a small, predictable set of things on the host. Ataris watches it with eBPF.

Example (firecracker · pid 7141): syscalls = expected set; children = none; files = inside jail.

### 2. Trip: Trip on anything else.

Unexpected host syscalls, new processes, files outside the jail, foreign access to guest memory or devices.

Example (vmm-71): execve = /bin/sh; syscall = ptrace; sandbox = vm-41aa.

### 3. Escalate: Top of the queue.

A tripwire becomes a high-ranked case with the host, sandbox, and process tree attached, sent to your webhooks.

Example (queue): #1 = escape tripwire · vm-41aa; host = host-a17; webhook = sent.

## Firecracker security, and every other layer.

Tripwires for each isolation runtime in a mixed fleet.

- **microVMs.** Firecracker, Cloud Hypervisor. VMM behavior, host syscalls, guest memory access.
- **Kata.** VM-backed containers. VMM behavior, host syscalls, device tampering.
- **Containers.** gVisor and runc. sandbox process behavior, host syscalls, files outside the sandbox.

## Related

- [Escape tripwires](https://ataris.dev/product/escape-tripwires.md): Know if anything breaks isolation
- [Host sensor](https://ataris.dev/product/host-sensor.md): eBPF on the host, Helm or Linux package
- [AI agent sandboxes](https://ataris.dev/use-cases/agent-sandboxes.md): Firecracker, gVisor, Kata, containers

## Know, rather than hope.

Book a demo and we'll walk through the tripwires for your isolation stack.

[Book a demo](https://ataris.dev/contact)