← All tech

Modal

containercloud-platform

A serverless compute platform that isolates workloads with gVisor, stronger than runc, weaker than a hardware VM.

Modal is a proprietary serverless compute platform that isolates workloads with gVisor, Google's userspace kernel. That is stronger than a plain runc container because it interposes a userspace kernel and shrinks host-kernel attack surface, but it is still a shared-kernel boundary, not a hardware VM. is open by default with an allowlist API. It is one of the platforms agent frameworks rent isolation from.

Strengths

  • gVisor isolation, reduced host-kernel attack surface, runs without nested virt
  • Serverless ergonomics for running code at scale
  • Egress allowlist API available

Limitations

  • Shared kernel, gVisor is a hardened container, not a hardware boundary
  • Proprietary; not self-hostable
  • Egress open by default

Files & editor

edit-inside

Programmatic sandboxes driven from your code, not an interactive editor target.

How you get your project into the environment and edit it. Shared-kernel routes bind-mount host files for your desktop editor; own-kernel routes keep files in the guest, so a desktop editor attaches over remote, or you edit inside. Mounts and remote editing.

Secrets

secrets: managed

Modal Secrets inject environment variables into the sandbox; code can read them once injected.

The realistic agent threat is exfiltration, not a kernel escape. Keeping credentials out of the code's reach is what defends against a prompt-injected agent stealing your keys. Keeping keys out of the blast radius.

Sources