Modal launches Sidecars: a low-latency trust boundary for Sandbox

Modal releases Sidecars, a container that runs on the same host as the main Sandbox but remains isolated, used to establish a security boundary between trusted and untrusted code. Sidecars use the same isolation mechanism as the main Sandbox (gVisor or VM), communicate via TCP/UDP over an internal bridged network and are addressed by name. Official benchmarks show communication speed is at least 3x faster than standalone Sandboxes in the same region, with p50 single communication at 0.58ms versus 2.6ms and p99 at 1.4ms versus 44ms. Sidecars are dynamically created by the Modal SDK; code inside the Sandbox cannot create or modify them. A single Sandbox can run up to 250 Sidecars. The two share CPU and memory resources. Each Sidecar has an independent outbound network policy, and Sandbox outbound traffic can also be forced through a proxy Sidecar. Sidecars are currently in Beta.