AWS Nitro Sandboxes are lightweight virtual machines managed by the Nitro Hypervisor, giving each workload its own hardware-isolated boundary while running on a shared EC2 instance. The capability supports Amazon EKS pods, Amazon ECS tasks, and standalone VMs, including environments for AI agents and code generated by large language models. Its central benefit is combining stronger isolation for untrusted, multi-tenant, or regulated workloads with near-native EC2 performance, so organizations can share instance capacity across workloads while improving utilization and reducing compute costs. Cryptographic attestation can verify a sandbox’s integrity before secrets are released to it.
EKS pods and ECS tasks can each run in their own sandbox with a one-line configuration change, while continuing to use familiar AWS features such as Pod Identity, VPC CNI, EBS, EFS, S3, and CloudWatch. For more control, teams can launch sandboxes directly on EC2 using their own AMIs, orchestration, and virtual machine monitors. Amazon Linux and Firecracker are supported natively, and patches for other options are available. Nitro Sandboxes are available at no additional charge on most Nitro-based EC2 instances in all commercial AWS Regions. AWS directs users to the EKS and ECS guides for setup and the EC2 user guide for implementation and customization details.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US Commerce Department has delayed adding Singapore-based Megaspeed to a trade blacklist, despite concerns it helped smuggle Nvidia chips into China. Other agencies pushed for the listing, while Commerce said it needed more information about some companies under review. (ft.com)
Wyndham’s Android app contained a password that gave access to an internal database holding customer details, login tokens, and company files. Wyndham revoked the credential after a researcher reported it, but the company has not said how many records were exposed or whether customers will be notified. (techcrunch.com)
Seven months into Project Glasswing, Anthropic has logged 37,966 security findings but made only 217 fixes, while adding nearly 12,000 findings and just 15 fixes since September. Maintainers are also disputing many scanner reports, raising questions about the project’s claimed accuracy and the burden placed on open-source teams. (vulncheck.com)
rVPN is an open-source VPN protocol that disguises encrypted traffic as ordinary HTTPS to work around VPN blocking. It uses a Rust core, rotating encryption keys, and probe-resistant decoy responses, with code and builds available for verification. (rvpn.org)
CVE-2026-116928 is a remote code execution vulnerability in Windows Search. The provided information does not specify its cause, impact, or affected versions. (msrc.microsoft.com)
A flaw in OpenSSH on Alpine Linux and other musl-based systems can let attackers bypass password authentication with a single SSH connection. Install the security patch and restart OpenSSH; systems with password authentication enabled and no PAM are affected. (zdnet.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.