Containers

Every YOLO Studio workspace runs inside its own lightweight virtual machine via Kata Containers  — not just Linux namespaces. This page covers what runs inside a workspace pod. For the host topology and isolation guarantees, see Sandbox isolation.

Isolation model

Each workspace pod boots its own guest kernel inside a small VM. From an end-user perspective:

• A kernel-level escape inside one workspace cannot reach another workspace or the host.
• uname -a from inside a workspace shows the guest kernel, not the host kernel — that’s how you can verify isolation is active.
• The host fleet refuses to schedule workspace pods on hardware that doesn’t expose /dev/<Term id="kvm">kvm</Term>, so isolation never silently downgrades.

Base Image

Containers are built on an Ubuntu 22.04 base with:

• Node.js (via NVM)
• Python 3
• Git, SSH, and common dev tools
• Claude Code, Codex, Gemini CLI, and the YOLO CLI binaries (yolo, opencode-yolo) pre-installed. The GitHub Copilot agent (gh copilot) installs on first use — see CLIs. The yolo-router gateway client is not currently baked into the published images.
• Community agent CLIs (Aider, Goose, OpenCode, Qwen Code, Neovate, Groq Code, …) install on first use rather than being baked in. The interactive agent picker bridges to a container-API install endpoint and streams install output into the terminal before launch. See Agent Registry.

Specialized flavors layer language toolchains on top of the base — yolo-python, yolo-rust, yolo-go, yolo-ops (SRE/infra tooling), and yolo-react-native (Expo/EAS, JDK 17, Android SDK). All sandbox flavors are available to operators at workspace-creation time; the active sandbox can be hot-swapped at runtime without losing the workspace’s PVC contents or open tiles.

User Environment

All user processes run as the yolo user (UID 1000, GID 1000) with home directory /home/yolo. The entrypoint starts as root for system services (sshd), then drops to yolo for user workloads.

Services

Port 3000 is yours. These service ports are reserved — a dev server or preview must never bind them — but 3000 is deliberately left free, so next dev, Vite, CRA and Remix work on their defaults with no configuration. (7777 and 7778 are also held in reserve; they belonged to the retired profile daemon and file watcher.)

Resource Limits

Containers run with defined CPU and memory limits. If a container exceeds its memory limit, it will be OOM-killed and restarted automatically.

Kata adds a small per-pod memory overhead (a few hundred MB) for the guest kernel and the QEMU process itself — workspace tiers are sized with this baked in.