---
title: "Product updates: VM Sandboxes, Lower latency routing, RBAC, and more"
description: "Modal also announced several product updates including VM Sandboxes in alpha, lower latency regional routing, and role-based access control. VM Sandboxes, currently in alpha, are a new VM runtime that runs a real Linux kernel, supporting Docker containers and Linux features like eBPF, systemd, cgroups, and custom filesystem mounts for better I/O performance. Regional routing lets Functions run in US West, EU West, or Asia Pacific South instead of default US East with a single setting, lowering latency and keeping data in-region. RBAC is now available for Team and Enterprise plans, with Environments as security boundaries and read-only defaults via Restricted Environments, tied into Audit Logs. Other updates include domain allowlisting, named images, volume subdirectory mounts, readiness probes, configurable snapshot TTLs with a 30-day default, SDK updates, and a partnership with Anthropic for Claude Managed Agents."
---

# Product updates: VM Sandboxes, Lower latency routing, RBAC, and more

[Modal](https://yomu.fyi/company/modal) · Jun 15, 2026

**Type:** Announcement

## Summary

Modal also announced several product updates including VM Sandboxes in alpha, lower latency regional routing, and role-based access control. VM Sandboxes, currently in alpha, are a new VM runtime that runs a real Linux kernel, supporting Docker containers and Linux features like eBPF, systemd, cgroups, and custom filesystem mounts for better I/O performance. Regional routing lets Functions run in US West, EU West, or Asia Pacific South instead of default US East with a single setting, lowering latency and keeping data in-region. RBAC is now available for Team and Enterprise plans, with Environments as security boundaries and read-only defaults via Restricted Environments, tied into Audit Logs. Other updates include domain allowlisting, named images, volume subdirectory mounts, readiness probes, configurable snapshot TTLs with a 30-day default, SDK updates, and a partnership with Anthropic for Claude Managed Agents.

## Takeaways

- VM Sandboxes run a real Linux kernel, enabling Docker containers and Linux features like eBPF, systemd, cgroups, and custom filesystem mounts.
- Regional routing allows Functions to be set to run in US West, EU West, or Asia Pacific South with a single setting, reducing latency and keeping data in-region.
- RBAC uses Environments as security boundaries, with Restricted Environments making workspace members read-only by default and tying into Audit Logs.

## FAQ

### What are VM Sandboxes?

VM Sandboxes are a new alpha runtime that runs a real Linux kernel, supporting Docker containers and Linux features like eBPF, systemd, cgroups, and custom filesystem mounts for better I/O performance.

### How does regional routing work?

Functions can be configured with a single setting to run in US West, EU West, or Asia Pacific South instead of default US East, lowering latency for requests from those regions and keeping data in-region.

### What is the default TTL for Sandbox Snapshots?

Starting in SDK 1.5 Python or 0.8 JS/Go, the default TTL is 30 days. You can retain the previous indefinite TTL by specifying ttl=none.

**Tags:** [Networking](https://yomu.fyi/topic/networking), [RBAC](https://yomu.fyi/topic/rbac), [Sandboxing](https://yomu.fyi/topic/sandboxing), [Serverless](https://yomu.fyi/topic/serverless), [Virtualization](https://yomu.fyi/topic/virtualization)

- Source: [Modal](https://modal.com/blog/product-updates-vm-sandboxes-domain)
- Source URL: https://modal.com/blog/product-updates-vm-sandboxes-domain
- Ingested by Yomu: 2026-09-20T07:46:56.619Z

[Read original post](https://modal.com/blog/product-updates-vm-sandboxes-domain)