Server-side sandboxing: Virtual machines | Figma Blog (opens in new tab)

Virtual machines provide strong workload isolation by separating guest systems from the host and from one another through a hypervisor. However, VMs are not a complete security solution: hypervisor vulnerabilities can enable escapes, while compromised workloads may still abuse network access or credentials. Figma therefore treats VMs as one layer in a broader defense-in-depth sandboxing strategy.

The VM Security Model

• A VM acts like an independent computer with its own CPU, memory, disk, and operating system.
• The hypervisor manages multiple VMs on a physical host and enforces separation between:
  • The host and guest VMs
  • Individual guest VMs
• The primary escape risk is a VM escape, in which malicious code breaks through the guest boundary and accesses the host or other guests.
• Hypervisors provide a useful security boundary, but they have a large and complex attack surface because they mediate operating-system and hardware operations.
• Cloud providers such as AWS and Microsoft Azure rely heavily on hypervisor-based VM isolation, meaning most cloud workloads inherently depend on this boundary unless they use bare-metal instances.

VM Permissions and Blast Radius

• Preventing VM escapes is only one part of the security model.
• A compromised workload may still:
  • Make network calls to exfiltrate data
  • Invoke other services
  • Abuse credentials assigned to the VM
• VM capabilities must therefore be restricted to limit the damage caused by a compromised job.
• Security depends not only on the hypervisor, but also on carefully controlling the guest’s permissions, network access, and available resources.

Engineering Trade-offs

• VMs generally offer stronger isolation than lighter-weight mechanisms such as containers and seccomp.
• Their disadvantages include greater operational complexity, resource overhead, and dependence on the security of the hypervisor.
• Building or deeply analyzing a specialized hypervisor requires substantial expertise because of its broad attack surface.
• In many cloud environments, relying on VMs is unavoidable, so teams should focus on reducing guest privileges and layering additional controls around the VM.

A VM should be treated as a strong isolation boundary, not an all-purpose security guarantee. The safest design combines hypervisor isolation with restricted permissions, controlled networking, and other defenses that minimize the impact of a compromised workload.