Infrastructure
Every YOLO Studio workspace runs as its own lightweight virtual machine, on dedicated bare-metal hardware. This page is the operator-facing summary of what that means; the next page goes deeper on the sandbox itself.
What you get
- Hardware-level isolation per workspace. Your workspace runs inside a Kata Container , a pod that boots its own guest kernel, not a process sharing the host’s. It is designed so a kernel-level escape inside one workspace stays inside that workspace.
- Bare-metal hosts. Workspace pods run on dedicated bare-metal machines, not shared cloud VMs. They use real hardware virtualization (
/dev/kvmis mandatory) rather than VMs nested inside a shared cloud. - Cloudflare-fronted networking. Inbound traffic terminates at Cloudflare for TLS, DDoS protection, and anycast routing before it reaches the sandbox hosts. Origin ports are firewalled to Cloudflare’s address ranges only.
- Single observability pipeline for control-plane and infrastructure. Stdout, OpenTelemetry traces, and metrics from the API, the auth service, the LLM gateway, the work dispatcher, and the cluster’s infra pods (CNI, DNS, k8s-gateway, pod-status-sync, CSI) flow through one OTel pipeline tagged with the cluster identity. Workspace session pods are intentionally outside this default pipeline — the workspace runtime emits structured events for them through a separate gateway path so that support and engineering can still follow what an agent is doing inside a session.
Why hardware isolation
Workspaces run real shells with real network access, executing code agents and operators wrote moments ago. A traditional shared-kernel container model puts every workspace on the same kernel as the host and every other workspace on that node — a single kernel CVE compromises the whole node.
gives every workspace its own guest kernel. A compromised process inside workspace A cannot see, signal, or exploit kernel state in workspace B, because B’s kernel is a different kernel running in a different VM. The trade-off is roughly one to two extra seconds at workspace cold-start (boot time for the VM) and a few hundred MB of memory overhead per pod. For a workspace that lives for minutes to hours, that cost is invisible.
Control plane vs. sandbox
YOLO Studio’s own services — the API, auth, the LLM gateway, the work dispatcher — run separately from where your code runs. Those control-plane services never execute untrusted code, so they don’t need the VM-level isolation that the sandbox does. Splitting them lets each side be tuned for its actual workload.
You don’t need to know anything about that split to use the product. The interesting half is the sandbox.
Next
- Sandbox isolation — the architecture of the VM-isolated host fleet that runs your workspaces.
- Containers — what’s installed inside a workspace pod.
- Workspaces — how workspaces, desktops, and tiles are organized for the operator.