Choose sandbox tier 2
For: cluster operators.
Tier 1 puts a process in its own namespaces on the node's kernel. Tier 2 puts a kernel of its own between the process and the node's: a user-space kernel (gVisor) today, a microVM or a remote sandbox next. You do not label nodes for it: a node finds what it can run, checks it, and reports it, and the edge labels the node from that report.
Choose a task
| Task | Guide |
|---|---|
| Set up gVisor | Open guide |
| Set up microVM isolation | Open guide |
| Configure remote sandboxes | Open guide |
The labels
Each isolation has a label of its own, so a node can offer several:
| Label | What the node offers | Where it comes from |
|---|---|---|
isolation.gvisor=ready | gVisor's runsc registered with a rootful Docker or Podman, and a test container under it worked when the node started | oz0-node run, from the container runtime |
isolation.gvisor-sandbox=ready | gVisor's runsc run rootless by the node itself, for harness sessions and command tools, inside the node's limits (in this guide) | oz0-node run, which runs a test command under it when it starts |
isolation.microvm=ready | a microVM runtime: smolvm inside tier 1 (Linux with KVM) or Apple's container (macOS 26), experimental | oz0-node run, which boots one test VM when it starts |
isolation.remote=ready | a remote-sandbox backend that answered when the node started, for tenants whose admins allowed remote sandboxes (in this guide) | oz0-node run --remote-sandbox, from the backend's hello and a list of the node's sandboxes |
The labels are facts, like runtime.oci=ready: setting isolation.gvisor=ready on a node yourself does nothing, since the edge drops a ready the node's report does not back. You can take a node off that work by setting the label to anything else, such as isolation.gvisor=off.
A tool asks for its isolation in its plugin's manifest, and the plugin's agents that call it then require the label, as they require runtime.oci=ready for a tool from an image:
tools:
- id: acme_fetch
package: oci:ghcr.io/acme/fetch-mcp@sha256:4f6c0d1b5e8a…
isolation: gvisor # runs only under gVisor, never without it
container: {memory_mb: 256}
A node that does not offer it leaves the tool out and says why in plugin list --json (leftOut), for example it runs only under gvisor, which this node does not offer (rootless Docker cannot run gVisor (gVisor issue 12575): …). An agent of another plugin, or a flow's tool step, must ask for the label itself (requires: {labels: {isolation.gvisor: ready}}); plugin lint warns about flows.
oz0 node show <node> has a Tier 2 line, and the Nodes page a Tier 2 row when you open a node.
Previous section links
gVisor: open guide.
Set up a node: open guide.
How a tool runs under it: open guide.
A tenant that requires it: open guide.
gVisor without Docker: open guide.
What is tested: open guide.
microVMs: open guide.
Set up a Linux node: open guide.
How a tool runs in one: open guide.
macOS 26: open guide.
What is tested: open guide.
Remote sandboxes: open guide.
Set up a node: open guide.
Allow it for a tenant: open guide.
In a plugin: open guide.
Egress is the service's, and weaker: open guide.
When sandboxes end: open guide.