Sandbox infrastructure with
nested virtualization.
Run your own hypervisor, and send sandbox traffic out through IP space you announce yourself. Nested on Zenlayer Elastic Compute, or native on Bare Metal Cloud.
// teams shipping on Zenlayer
ZEC instance
nested virt
Your hypervisor
your boundary
Guest sandboxes
01
Nested virtualization: run your own hypervisor on ZEC
Nested virtualization usually decides where a sandbox product can run. A runtime that gives every pod its own microVM only works if the instance it runs on exposes hardware virtualization.
- Set the nested virtualization option at creation, and the runtime you already use works without a rewrite.
- You choose the hypervisor that runs inside the instance, and the guest kernel your sandboxes boot.
- Pair it with Global VPC so one private network reaches every sandbox host across regions.
Nested virtualization is switched on per account, so ask us before you provision.
02
Public NAT gateway, load balancers, and custom images on ZEC
A sandbox product is more than its guests. The orchestration around them runs on ZEC too, on the same network as the pods themselves.
- Custom images mean every ZEC host boots the build you already hardened, kernel and agent included.
- A load balancer fronts the pods, and security groups set what each instance can reach.
Boot
Custom images
Hosts boot your build
Ingress
Load Balancer
In front of your pods
Outbound
Public NAT Gateway
Egress from private subnets
Perimeter
Security Group
L3/L4 rules per instance
announced over BGP
Your address space
your prefix · your ASN
Elastic IPv4 & IPv6
IP Pool allocations
IP Rotation
Global VPC
03
Control sandbox egress with BYOIP and your own ASN
Your sandboxes are judged by the addresses they exit from. Announce prefixes you hold under your own ASN, and that reputation stays yours.
- Announce prefixes you hold at your RIR with BYOIP so egress reputation follows your organization, not a shared pool.
- Run BGP under your own ASN. IP Pool manages allocations across the whole fleet, not machine by machine.
- Swap a host's public IP on demand with IP Rotation when an exit address gets burned.
Choose your exit geography from 30 regions across APAC, the Americas, EMEA, and Africa.
DEPLOY
Start on ZEC today
Anything that doesn't need nested virtualization deploys from the console now.
2 vCPU · 4 GB RAM
- ·20 GB NVMe storage
- ·2 Gbps per vNIC, unthrottled
- ·1 IPv4 EIP included
$0.0421/hr
Est. $30/mo running 24×7
Most pick
4 vCPU · 8 GB RAM
- ·20 GB NVMe storage
- ·4 Gbps per vNIC, unthrottled
- ·1 IPv4 EIP included
$0.0782/hr
Est. $56/mo running 24×7
8 vCPU · 16 GB RAM
- ·20 GB NVMe storage
- ·6 Gbps per vNIC, unthrottled
- ·1 IPv4 EIP included
$0.1504/hr
Est. $108/mo running 24×7
Every instance runs on latest-generation AMD CPUs (x86-64) with all-NVMe SSD storage.
+ Data transfer
Egress on a Tier-1 backbone trusted by enterprises and carriers worldwide. Pay metered per GB for the data you move, or commit bandwidth by the Mbps.
$0.002/GB
metered egress
or $0.20/Mbps committed
Representative pricing for US regions.
04
Bare metal servers for fast sandbox start-up
On Bare Metal Cloud there is no nesting layer to cross. Sandboxes start faster, and start-up time is what your own customers feel. These four standard configurations each target a different workload shape, so you never pay for idle cores.
- Single-tenant hardware, with nothing else scheduled against your cores.
- On bare metal that control extends to the host kernel, with nothing running underneath it.
- BYOIP and Global VPC extend to BMC too. See all bare metal configurations
Where there's stock, order immediately. Build-to-order runs 6–8 weeks.
| Configuration | CPU | Cores | Built for |
|---|---|---|---|
| General Purpose | EPYC 4545P | 16 | Control planes, APIs, orchestrators |
| Latency Optimized | EPYC 4585PX | 16 | Interactive sessions, high-frequency cores |
| Throughput | EPYC 9354P | 32 | Sample stores, analysis pipelines |
| Concurrency | EPYC 9554P | 64 | Dense concurrent guests, most per host |
05
What to expect when you order
Three different clocks. Plan around the slowest.
ZEC — today
Create ZEC instances from the console or the API. Anything that doesn't need nested virtualization starts now.
Nested virtualization — one request
An account-level switch. Talk to us first, then provision, so the option takes effect on everything you create afterward.
BMC — in stock, or 6 to 8 weeks
Order available inventory immediately. Anything built to order runs 6 to 8 weeks from order to handover.
Some teams run production entirely on ZEC. Others go to bare metal for the fastest start-up. Both are real production paths, and you can start on ZEC either way.
Sandbox infrastructure FAQ
Nested virtualization, hardware, and egress.
Does Zenlayer support nested virtualization?
Yes. It's a ZEC instance option set at creation and activated per account. Contact us to switch it on before you provision, otherwise the option is accepted but does nothing.
Should I run a sandbox fleet on ZEC or BMC?
Both are production paths. Many teams go to bare metal for the fastest start-up, because building directly on the metal removes the nesting layer. Others run the whole platform on ZEC, where nested virtualization gives every pod its own microVM.
Can I use my own IP ranges for sandbox egress?
Yes. BYOIP lets you announce prefixes you hold at your RIR under your own ASN, validated with RPKI and IRR. Egress reputation stays attached to your organization.
How long does a bare metal order take?
It depends on stock. Where inventory is available in your target zone, you can order it immediately. Build-to-order runs 6 to 8 weeks across the four published configurations. Ask us to check current stock for the zones you need.
Which regions can I run sandboxes in?
30 regions across APAC, the Americas, EMEA, and Africa, including Jakarta, Manila, Ho Chi Minh City, Bogotá, and Riyadh. Tell us the regions you need and we'll map them to your fleet.