Which Sandbox Providers Run on ARM64 Without x86 Emulation
Compare which sandboxes truly run on ARM64 hosts, not just images.
To choose a sandbox that runs on ARM64 without x86 emulation, teams need to check the machines doing the work as well as image compatibility. For Firecracker, native support is a hard requirement. The best choice depends on whether the provider’s ARM64 execution path also meets the team’s needs for saved state, development workflow, and compliance.
Why Firecracker's architecture constraint makes ARM64 support binary, not a spectrum
Firecracker requires the guest OS and host CPU to share the same architecture. Firecracker deliberately confines guests on x86_64 and aarch64 hosts to the host architecture by stripping out legacy device emulation and leaving cross-architecture translation outside its scope. Its Linux hosts must have KVM, hardware virtualization extensions, and the required device file, whether they run on x86_64 or aarch64. A Firecracker provider therefore needs genuine ARM64 hosts to offer ARM64 execution.
QEMU-based full VMs or Kata Containers offer cross-architecture emulation, but with a different trade-off. That uses an execution model separate from Firecracker. For teams with GPU requirements, that distinction belongs to a broader platform decision, since Firecracker is not an option regardless of architecture.
What is driving teams toward ARM64 hosts in the first place
The cost of Graviton is pushing managed sandbox providers toward ARM64 bare metal, so native support matters more and more to AI teams that need to keep costs down. AWS developed Firecracker, which is validated against AWS Graviton 2, 3, 4, and 5 hosts running Linux kernels 5.10, 6.1, and 6.18. The hardware and software paths are aligned. For teams choosing infrastructure now, ARM64 is therefore more than a local development preference. It is part of the managed sandbox market’s direction.
Development pressure reinforces that shift from the other end. Teams using Apple Silicon already develop on aarch64, while an x86_64 production fleet introduces an asymmetric CI/CD burden. What happens when the workflow has saved execution state as well as source code? Firecracker snapshots do not cross architectures, so state saved on ARM64 cannot follow the workload to x86_64. That makes architecture selection an operational decision before any comparison of provider features begins.
How to tell whether a provider's ARM64 support is genuine
The evaluation starts with three questions about execution. Does the provider run ARM64 host machines, or does it only accept ARM64 container images? Do those hosts expose KVM and hardware virtualization extensions? Are snapshots both generated and restored on ARM64, or does the stateful path fall back to x86? Together, these questions separate image compatibility from a native Firecracker deployment.
An ARM64 image is not sufficient evidence by itself. A provider can accept that image and run it on x86_64 hosts through QEMU emulation, but that does not make the service ARM64-native. The guest may work without meeting the architecture requirement for a Firecracker-native ARM64 sandbox. Accepting the image also does not prove that saved state can move through the workflow the team plans to use.
Kernel page size adds another selection criterion. Firecracker currently supports only one page size for host and guest kernels on aarch64, while some ARM64 Linux distributions default to a larger page kernel. This remains an open limitation of Firecracker itself. A provider should nevertheless be able to explain how its hosts satisfy that constraint. For self-hosted options, explicit documentation of aarch64 host support, a minimum kernel version of 5.10+, and hardware virtualization prerequisites provides a more useful signal than a general “multi-arch” claim.
Providers with confirmed native ARM64 support
Amazon Bedrock AgentCore Runtime presents the clearest managed case. Its original serverless compute path is ARM64-only on Graviton, and container images must be built for ARM64. A plain docker build on most x86 laptops produces an amd64 image that gets silently rejected at deployment. AWS added an Instances compute type in August 2026 that supports both x86_64 and arm64. That broadens the product’s architecture options without changing the ARM64-only requirement of the original serverless path.
AgentCore V2 boots the container once, snapshots the healthy process, and restores that snapshot for each new instance. Cold starts become flat regardless of image size, and idle memory is reclaimed after 120 seconds. Its compliance documentation also makes it the strongest documented choice here for regulated workloads. The relevant distinction is the specific compute path, rather than an assumption that every AgentCore deployment uses ARM64.
Namespace supports multi-arch execution natively across its platform. The same underlying platform powers Buildkite Hosted Agents and Warp Background Agents, with CI runners, Docker image builders, and native macOS/Windows compute across Linux on amd64 and arm64, macOS, and Windows. However, native ARM64 availability answers only the execution question. A team depending on portable Firecracker state still needs evidence about its particular snapshot and restore path.
Microsoft Execution Containers, or MXC, takes a different approach. Launched at Build 2026, it is an OS-level, policy-driven sandboxing system supporting Windows 11 24H2 or later, Linux on x64 and ARM64, and macOS on ARM64 and x64. Its default containment backend varies by platform. Windows defaults to ProcessContainer, Linux to Bubblewrap, and macOS to Seatbelt, with MicroVM and other backend choices available on Windows and Linux.
For teams evaluating MXC, the backend must fit the threat model. Because it works across platforms, teams can use it for sandboxing on developer machines or on-premises without a separate cloud provider. The SDK, @microsoft/mxc-sdk 1.0.1, requires Node.js 24 or later. This makes MXC a distinct option from a managed Firecracker service. The evaluation must establish the security boundary provided by the containment backend actually selected for ARM64 execution.
SmolVM is self-hosted and open-source under the Apache 2.0 license. It supports macOS on Apple Silicon and Intel, plus Linux on x86_64 and aarch64, and achieves sub-200ms cold starts through optimized kernel images, minimal device models, and aggressive caching of VM snapshots. There is no managed cloud tier. Apple Containerization is another open-source, self-hosted option, natively ARM64 on Apple Silicon but limited to macOS. Both can serve teams doing local ARM64 development, but teams still need to check what will work in production.
Providers that are x86-dominant or have ARM64 only in preview
CubeVM from Tencent illustrates why support status needs more precision than a yes-or-no label. Released in April 2026, it is x86_64-only in production, while native ARM64 support arrived in v0.5.0 in July 2026. Live migration remains x86_64-only. It is self-hosted, with GPU sandboxes on the roadmap. For an ARM64-dependent team, native support and production readiness are separate questions in this case.
PandaStack documents a different kind of architecture split. Local development on Apple Silicon runs Firecracker inside a Lima VM through Apple Virtualization.framework with nested virtualization, while production agents run on Linux KVM hosts or *.metal cloud instances on either x86_64 or aarch64. Running production on ARM64 keeps the architectures the same, but choosing x86_64 means local snapshots cannot move into production. It also creates the risk of architecture-specific bugs that the local environment cannot reproduce.
An x86-only production fleet may have no requirement for ARM64 state portability. A provider must support the architecture consistency a particular workload needs. Documentation of an ARM64 feature, or a choice between host architectures, does not establish that consistency on its own.
The snapshot portability problem and what it means for stateful agent workflows
AgentCore V2 shows why snapshot-based startup is attractive. Preparing an environment once and restoring its healthy process for new instances avoids repeating the full startup sequence. For long-running or resumable agent workflows, saved state raises a further question. Can that state be restored wherever the next stage of work runs? Architecture consistency is a prerequisite for that question to have a useful answer.
Firecracker snapshots are both architecture-bound and version-bound. A snapshot generated on aarch64 cannot restore on x86_64, and snapshots do not cross Firecracker versions either. Teams managing upgrades therefore face two constraints at once. Both belong in the deployment design for any workflow that depends on restore.
Consider a team that saves state on ARM64 machines used for development and deploys to an x86_64 managed fleet. The saved execution state cannot make that transition. The team must rebuild from scratch at deployment rather than resume the snapshot, defeating the intended stateful handoff. Teams need to align development, CI, and production when state must move between them. Compatible kernel page size remains a host-selection prerequisite, but it does not solve cross-architecture portability.
Enterprise compliance on ARM64: what the sources actually confirm
Sandbox compliance attestations are mostly expressed at platform level. That leaves a specific question for an enterprise buyer. Does the attestation cover the ARM64 execution path the workload will actually use? An ARM64 offering in preview or on a different infrastructure tier may not fall within the same scope as the platform’s x86 path. The compliance scope of the ARM64 execution path requires verification.
AWS documents AgentCore’s SOC 1, 2, and 3 coverage in July 2026, HIPAA eligibility from February 10, 2026, and general availability in AWS GovCloud (US-West) as of May 2026. HIPAA eligibility requires an executed AWS BAA. Because the original serverless path is ARM64-only, the product documentation provides the clearest alignment here between compliance and ARM64 execution. That is stronger evidence than a platform-wide claim disconnected from the selected compute tier. It does not remove the need to check which configuration the team intends to deploy.
For other providers, the notes do not establish comparable ARM64-specific coverage. Absence of that evidence is not proof of exclusion. The practical step is to ask whether the relevant certification covers the actual ARM64 hosts, compute tier, and execution path.
How to run ARM64 CI and production on the same architecture
For teams ready to choose, the decision sequence begins at the host. Confirm that the provider runs ARM64 machines with KVM. Then verify the host kernel page size against Firecracker’s aarch64 requirement, since a larger page kernel is incompatible. Next, check that snapshots are both generated and restored on ARM64. For a managed service, the final check is whether the relevant compliance coverage applies to that compute path.
Teams that develop on Apple Silicon can use Apple Containerization and SmolVM to run ARM64 locally. Those tools can align local development with production at the architecture level, but only when the production provider also runs ARM64 hosts. CI must preserve the same alignment. A native local environment and a native production environment do not establish an end-to-end stateful workflow if the intervening stage uses another architecture. Firecracker version compatibility must also remain part of snapshot planning.
Some teams cannot standardize the whole pipeline today. In that position, the practical recommendation is to run CI on both architectures rather than assume one will catch the other’s architecture-specific bugs. The extra CI lane addresses testing risk. A mixed-architecture workflow still cannot transfer Firecracker snapshots across the boundary, so the provider decision must distinguish workloads that can restart from those that must resume saved state.
