Root, Docker and nested virtualization

Do you get root in a Sandboxer sandbox?

Yes. You work as an ordinary user named user, with home /home/user and passwordless sudo. That means you can install anything with apt, edit system files, open firewall ports and enable systemd services. Per the machines docs, services you enable come back after a resume or fork.

sudo apt-get install -y postgresql
sudo systemctl enable --now postgresql

How does Docker work inside a sandbox?

Docker is preinstalled with BuildKit, Compose and buildx, and each sandbox runs its own Docker daemon. You do not need to mount a host socket or run privileged containers, because the whole VM is yours.

docker compose up -d
sbx host <sandbox-id> 8080

Sandboxer's Docker Compose guide gives each published port its own HTTPS URL with sbx host. A stop and resume with memory keeps containers running; add restart: unless-stopped so they also return after a cold boot.

One practical note from the security docs: outbound traffic shares the node's IP addresses with other sandboxes, so services that rate-limit by IP, such as Docker Hub pulls, see one shared limit. Run docker login to use your own account's limit.

Can you run Kubernetes in a sandbox?

Yes. kind and k3s both work. In Sandboxer's Kubernetes guide, kind create cluster reached a Ready node in about 28 seconds in one run on a default sandbox, and the k3s install script took about 13 seconds. You deploy with kubectl, expose the app with a port-forward or NodePort, then host the port for an HTTPS URL.

kind create cluster
kubectl get nodes

What is nested virtualization and why does it matter?

Nested virtualization means running a virtual machine inside your sandbox's VM with hardware acceleration. Sandboxer exposes /dev/kvm to every guest, so hypervisors work without slow software emulation. That opens up workloads containers usually cannot host:

• QEMU/KVM virtual machines
• Firecracker microVMs
• The Android emulator, accelerated

ls -l /dev/kvm
sudo apt-get install -y qemu-system-x86
qemu-system-x86_64 -enable-kvm -m 2048 -nographic -cdrom alpine.iso

Use large or xlarge for nested VMs, because the inner guest's RAM comes out of yours.

Can you run the Android emulator in the cloud?

Yes. Sandboxer's Android emulator guide creates a large sandbox, installs the Android command-line tools and an x86_64 system image, and starts the emulator with acceleration on. It reports that Android 15 cold-boots in about 30 seconds. You can run it headless and drive it with adb, or put its window on the sandbox's streamed desktop and watch it in a browser.

Stop the sandbox with memory saved and resume it with the emulator still booted, or save a named snapshot so every new sandbox starts with the SDK installed. See the Android and nested VM use case.

Which size should you pick?

The disk figure is space for your files on top of the OS image. You can grow a sandbox on resume or fork, but not shrink it. Prices are on pricing.