A V8 isolate is a lightweight JavaScript execution context that shares a single OS process with thousands of other tenants. A VM is a hardware-virtualized machine with its own kernel, booted in milliseconds, that provides full OS-level isolation. The choice between them is the central design question in agent compute today, and the answer depends on what your agents actually do.
What Cloudflare Got Right About Agent Compute Economics
On August 3, Cloudflare published "Your agent needs a computer, not a container", and the core economic argument is solid. Matt Carey and Aron Carroll point out that "across all the clouds, all the hyperscalers, there's nowhere near enough compute in the world for every company to give each of their users' agents their own containerized compute environment." If you spin up a full container per agent invocation, you're paying for a cold start measured in seconds and idle memory measured in hundreds of megabytes. At agent-scale concurrency, that math breaks.
They're right. Traditional container-per-agent architectures don't scale. The question is what you replace them with.
Cloudflare's answer is V8 isolates: the same runtime that powers Workers, now extended with a SQLite-backed "workspace" filesystem, a shell translation layer called just-bash, and FUSE-mounted containers for the minority of work that needs real binaries. Their stated goal is that "a container is required for less than 10% of its work." The launch tweet framed it cleanly: "Your agent needs a computer, but sometimes a full Linux container is overkill."
This is a reasonable architecture for a specific class of workloads. But the framing elides a critical assumption: that most agent work is JavaScript-shaped.
What an Isolate Actually Is (and What It Can Never Be)
Isolates are an efficient in-process execution model for restricted workloads. They can provide strong practical isolation when paired with a hardened platform, but they are not a general Linux environment and do not run arbitrary native binaries directly.
A V8 isolate has its own heap and JavaScript runtime state, but it runs inside a host process and relies on the engine and platform runtime for isolation. A VM instead has a separate guest kernel and hardware-assisted memory isolation.
This isn't theoretical pedantry. When an AI agent executes arbitrary code from an untrusted user, the threat model is fundamentally different from serving HTTP responses. The agent might pip install a malicious package. It might download and execute a binary. It might attempt to read /proc or mount a device. In an isolate, none of these operations exist. In a VM, they exist and are contained by hardware — the VM boundary enforced by the CPU's virtualization extensions (VT-x/AMD-V).
The 10% Problem
Cloudflare's architecture bets that a container is needed for less than 10% of agent work. Let's take that number at face value and ask: which 10%?
It's the 10% where the agent installs a system package. Runs a compiler. Launches a database. Executes a binary tool. Starts a headless browser. Uses GPU compute. Calls a CLI tool that expects /usr/bin and /tmp and stdout to behave like Linux, because it is Linux.
This is not the trivial tail of agent workloads. It's the high-value core. The agent that can only run JavaScript can answer questions. The agent that can run arbitrary code, install native dependencies, and interact with system-level resources can handle a fundamentally broader set of tasks.
Cloudflare themselves proved this point by building Kitesurf, an entirely new browser engine, because real Chromium cannot run inside an isolate. The Kitesurf numbers are impressive — screenshot CPU at 380ms versus 1,173ms for Chromium (3.1x faster), memory at 57.8 MiB versus 271.0 MiB (4.7x leaner), over 215,000 Web Platform Tests passing. But the fact that they had to build a new browser engine to give agents browser access inside isolates is itself the argument. In a VM, you just install Chrome.
"Just-Bash" and the Fidelity Tax
Cloudflare's just-bash layer translates shell commands into JavaScript equivalents. ls becomes a directory read. cat becomes a file read. Simple commands work.
But shell fidelity is a spectrum, and the long tail is vicious. Pipes, subshells, process substitution, signal handling, trap for cleanup — each of these interacts with POSIX process semantics that don't exist in a JavaScript runtime. Every gap is a silent failure mode where the agent's tool call succeeds syntactically but produces wrong results.
This is the fidelity tax: the ongoing engineering cost of maintaining a translation layer between what the agent thinks it's running and what actually executes. Every new shell idiom an LLM generates is a potential edge case. Every tool that shells out to another tool is a potential break. The alternative is to just give the agent a real shell, on a real Linux kernel, where bash is bash.
The VM Answer to the Economics Argument
The economic argument against VMs rests on two assumptions: cold starts are slow, and idle VMs waste resources. Both assumptions are stale.
At Dedalus, our VMs achieve sub-50ms cold starts with a full Linux environment, persistent filesystem, and per-second billing — you pay only for active compute. Docker's own CPO, Mat Velloso, noted the same week that "a container won't be enough and you will need a micro VM."
When a VM boots as fast as an isolate warms up, the economics argument collapses into an isolation argument. And on isolation, hardware virtualization wins by definition.
Choosing Honestly: Isolates vs VMs
- Dimension: V8 isolate: V8 Isolate; VM: VM
- Kernel: V8 isolate: Shared (host OS); VM: Dedicated (guest kernel)
- Native binaries: V8 isolate: No (JavaScript only); VM: Yes (full Linux userspace)
- GPU / CUDA: V8 isolate: No; VM: Yes
- Cold start: V8 isolate: ~5ms; VM: ~50ms
- Isolation boundary: V8 isolate: Language VM (V8); VM: Hardware (VT-x / AMD-V)
- Untrusted code: V8 isolate: Strong for JS-only; no syscall containment; VM: Safe by design
- Shell fidelity: V8 isolate: Translation layer; VM: Native bash
- Browser support: V8 isolate: Custom engine required; VM: Standard Chromium
- Cost at idle: V8 isolate: Near-zero (shared process); VM: Low (per-second billing + sleep/wake)
- Best fit: V8 isolate: Stateless, short, JS-safe tasks; VM: Arbitrary code, tools, full OS
Isolates are the right choice when your agent workload is genuinely lightweight: stateless function calls, JSON transformation, simple file manipulation, and you trust the code being executed. If your agents run in a controlled environment executing only your own code, the 5ms cold start and extreme density of isolates is a real advantage.
VMs are the right choice when agents execute untrusted code, need native tooling, require persistent state, or interact with system-level resources. If your agent might need to apt install something, run a Python script with native dependencies, use a GPU, or launch a subprocess, you need a real computer. Most agents that do real, useful work fall into that later camp.
FAQ
Are V8 isolates secure enough for AI agents?
For agents executing trusted, controlled code in a JavaScript-only environment, isolates offer strong language-level isolation. For agents running arbitrary or untrusted code, hardware-virtualized VMs provide a fundamentally stronger boundary, enforced by the CPU rather than a language runtime.
Can an isolate run Docker or a browser?
No. Isolates lack a kernel, so Docker cannot run. Standard browsers like Chromium require OS-level APIs unavailable in an isolate. Cloudflare built an entirely new browser engine (Kitesurf) to work around this limitation.
How fast can a VM cold start?
Dedalus VMs can cold start in as little as 50ms. The industry standard for full VMs is somewhere between half a second to several seconds, which can be challenging for agent workloads. That’s why Dedalus decided to optimize cold starts.
When should I use isolates instead of VMs?
When your agents run trusted JavaScript-only workloads, need extreme density (thousands of concurrent lightweight tasks), and don't require native binaries, GPU access, or full shell fidelity. Isolates excel at stateless, short-lived compute.