MicroVMs and Snapshots Are the Real Agent Infrastructure Stack

OpenAI’s infrastructure lead traces sandboxing evolution for LLM-generated code. He argues that only hardware-level virtualization (microVMs) can contain worst-case exploits; containers and gVisor still leave the host kernel reachable. The immediate operational implication: teams that start with containers eventually migrate to VMs for security and full Linux capability.

But the talk’s sharper insight is about disk persistence. Ephemeral sandboxes break long-running tasks and waste GPU tokens. Incremental block-level snapshotting using copy-on-write enables fast checkpointing, seamless recovery from node failures, and even Monte Carlo tree search by the agent. Storage becomes the next critical unlock.

Orchestration gets a similar upgrade: snapshot-aware scheduling routes sandbox creation to nodes caching the required disk layers, reducing cold-start latency. Hybrid warm-pool strategies and memory snapshots further cut latency. The trade-offs are real—microVMs carry overhead and limit GPU sharing—but security breaches are irreversible, while performance can be engineered.