---
title: "Choose sandbox tier 2"
description: "Choose a verified isolation capability for a node."
canonical_url: "https://docs.oz0.ai/fleet/sandbox-tier-2"
---
# Choose sandbox tier 2

> Choose a verified isolation capability for a node.

For: cluster operators.

[Tier 1](https://docs.oz0.ai/concepts/security/sandbox-tiers#sandboxes) puts a process in its own namespaces on the node's kernel. Tier 2 puts a kernel of its own between the process and the node's: a user-space kernel (gVisor) today, a microVM or a remote sandbox next. You do not label nodes for it: a node finds what it can run, checks it, and reports it, and the edge labels the node from that report.

## Choose a task

<table>
<thead>
  <tr>
    <th>
      Task
    </th>
    
    <th>
      Guide
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Set up gVisor
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor">
        Open guide
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      Set up microVM isolation
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/fleet/sandbox-tier-2/microvms">
        Open guide
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      Configure remote sandboxes
    </td>
    
    <td>
      <a href="https://docs.oz0.ai/fleet/sandbox-tier-2/remote">
        Open guide
      </a>
    </td>
  </tr>
</tbody>
</table>

## The labels

Each isolation has a label of its own, so a node can offer several:

<table>
<thead>
  <tr>
    <th>
      Label
    </th>
    
    <th>
      What the node offers
    </th>
    
    <th>
      Where it comes from
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        isolation.gvisor=ready
      </code>
    </td>
    
    <td>
      gVisor's <code>
        runsc
      </code>
      
       registered with a rootful Docker or Podman, and a test container under it worked when the node started
    </td>
    
    <td>
      <code>
        oz0-node run
      </code>
      
      , from the container runtime
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        isolation.gvisor-sandbox=ready
      </code>
    </td>
    
    <td>
      gVisor's <code>
        runsc
      </code>
      
       run rootless by the node itself, for harness sessions and command tools, inside the node's limits (<a href="https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#gvisor-without-docker">
        in this guide
      </a>
      
      )
    </td>
    
    <td>
      <code>
        oz0-node run
      </code>
      
      , which runs a test command under it when it starts
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        isolation.microvm=ready
      </code>
    </td>
    
    <td>
      a microVM runtime: smolvm inside tier 1 (Linux with KVM) or Apple's container (macOS 26), experimental
    </td>
    
    <td>
      <code>
        oz0-node run
      </code>
      
      , which boots one test VM when it starts
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        isolation.remote=ready
      </code>
    </td>
    
    <td>
      a remote-sandbox backend that answered when the node started, for tenants whose admins allowed remote sandboxes (<a href="https://docs.oz0.ai/fleet/sandbox-tier-2/remote#remote-sandboxes">
        in this guide
      </a>
      
      )
    </td>
    
    <td>
      <code>
        oz0-node run --remote-sandbox
      </code>
      
      , from the backend's hello and a list of the node's sandboxes
    </td>
  </tr>
</tbody>
</table>

The labels are facts, like `runtime.oci=ready`: setting `isolation.gvisor=ready` on a node yourself does nothing, since the edge drops a `ready` the node's report does not back. You can take a node off that work by setting the label to anything else, such as `isolation.gvisor=off`.

A tool asks for its isolation in its plugin's manifest, and the plugin's agents that call it then require the label, as they require `runtime.oci=ready` for a tool from an image:

```yaml [oz0-plugin.yaml]
tools:
  - id: acme_fetch
    package: oci:ghcr.io/acme/fetch-mcp@sha256:4f6c0d1b5e8a…
    isolation: gvisor                 # runs only under gVisor, never without it
    container: {memory_mb: 256}
```

A node that does not offer it leaves the tool out and says why in `plugin list --json` (`leftOut`), for example `it runs only under gvisor, which this node does not offer (rootless Docker cannot run gVisor (gVisor issue 12575): …)`. An agent of another plugin, or a flow's tool step, must ask for the label itself (`requires: {labels: {isolation.gvisor: ready}}`); `plugin lint` warns about flows.

`oz0 node show <node>` has a Tier 2 line, and the Nodes page a Tier 2 row when you open a node.

## Previous section links

<span id="gvisor">

gVisor

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#gvisor).

<span id="set-up-a-node">

Set up a node

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#set-up-a-node).

<span id="how-a-tool-runs-under-it">

How a tool runs under it

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#how-a-tool-runs-under-it).

<span id="a-tenant-that-requires-it">

A tenant that requires it

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#a-tenant-that-requires-it).

<span id="gvisor-without-docker">

gVisor without Docker

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#gvisor-without-docker).

<span id="what-is-tested">

What is tested

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor#what-is-tested).

<span id="microvms">

microVMs

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/microvms#microvms).

<span id="set-up-a-linux-node">

Set up a Linux node

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/microvms#set-up-a-linux-node).

<span id="how-a-tool-runs-in-one">

How a tool runs in one

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/microvms#how-a-tool-runs-in-one).

<span id="macos-26">

macOS 26

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/microvms#macos-26).

<span id="what-is-tested-1">

What is tested

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/microvms#what-is-tested-1).

<span id="remote-sandboxes">

Remote sandboxes

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#remote-sandboxes).

<span id="set-up-a-node-1">

Set up a node

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#set-up-a-node-1).

<span id="allow-it-for-a-tenant">

Allow it for a tenant

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#allow-it-for-a-tenant).

<span id="in-a-plugin">

In a plugin

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#in-a-plugin).

<span id="egress-is-the-services-and-weaker">

Egress is the service's, and weaker

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#egress-is-the-services-and-weaker).

<span id="when-sandboxes-end">

When sandboxes end

</span>

: [open guide](https://docs.oz0.ai/fleet/sandbox-tier-2/remote#when-sandboxes-end).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.