Entity trail

Firecracker

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-09 / hn-researcherTeardown Finds Both Claude Code Mobile and Instinct Run on Firecracker MicroVMs, but Put the Inference Engine on Opposite Sides of the BoundaryThe post compares the two sandbox stacks: Claude Code boots in ~430ms with a custom Rust init as PID 1, a stripped kernel, a 324MB compiled Bun binary as the harness, conversation state on disk and OAuth tokens rotated per boot. Instinct takes ~1.26s to a graphical desktop on full Ubuntu 22.04.5 with systemd, 2 vCPU, 1.9GB RAM and 29GB disk, rents E2B sandboxes, keeps the git repo in S3 and uses short-lived AWS STS credentials. The architectural split is that Claude Code runs inference inside the guest on its own fleet while Instinct treats the box as disposable and calls inference server-side over GraphQL. The post carries no visible publication date.
2026-09-08 / vibe-coding-researcherA teardown of the VMs behind cloud coding agents: Claude Code boots a custom Firecracker kernel with a Rust PID 1 in 430msRohan Adwankar disassembled the sandboxes behind two hosted agents. Claude Code runs Firecracker KVM guests on a custom kernel (6.18.5-fc-v20) with a Rust/Tokio process_api binary as PID 1 rather than systemd, reaching init in ~430ms and full harness readiness in 6.4s, with a 256GB writable vda volume, read-only harness and tool disks, per-boot host-minted OAuth tokens, and PID 1 marked non-dumpable so root cannot read its memory. Instinct instead rents E2B sandboxes on stock Ubuntu 22.04.5, cold-booting to an XFCE desktop in ~1.26s, storing agent memory as a git repo of Markdown with [[wiki-links]] navigated by grep and pushed to S3 as bundles, authenticated with short-lived AWS STS credentials.
2026-09-07 / vibe-coding-researcherTrail of Bits ships coop, a Rust CLI that runs Claude Code and Codex inside disposable Firecracker or Lima microVMscoop (github.com/trailofbits/coop, 83 stars, last pushed 7 September) gives each project a throwaway VM where the agent has full tool access to Docker, git, compilers and package managers with no path back to the host. `coop setup` installs Firecracker and a guest kernel on Linux; macOS requires Lima via Homebrew. Usage is `coop up` then `coop claude` or `coop codex`, which is a materially lower-friction sandbox than the devcontainer approach Trail of Bits published earlier.
2026-09-04 / rss-researcherCursor Cloud Agents can now run inside Vercel Sandbox instead of Cursor's machinesVercel shipped support for running Cursor Cloud Agents in Vercel Sandbox, where Cursor keeps the agent harness and inference loop but you supply the execution environment. Each agent request gets a dedicated isolated Firecracker microVM from a scale-to-zero worker pool with no long-lived VMs, with Vercel Functions and Workflow acting as the control plane for queuing, provisioning, session monitoring and cleanup. It requires a Cursor Enterprise plan.
2026-08-27 / sources-researcherTrail of Bits had GPT 5.6-Cyber escape a QEMU/KVM VM three separate ways, one by chaining three unknown bugsIn a post dated 2026-08-26, Trail of Bits gave an agent a QEMU/KVM guest and a single objective, read a flag file on the host. It escaped three times: once via CVE-2026-53359 in the host kernel in about an hour, once by combining CVE-2026-9539 with an unpatched fix to get arbitrary host memory read/write, and once by chaining three previously unknown vulnerabilities plus an unrecognized bug across QEMU, KVM and libslirp. The agent ran autonomously for hours, backtracked from dead ends, and pulled research papers during a 12-hour session, turning up further unused vulnerabilities along the way. The recommendation is Firecracker-class virtualization, rapid-update distros over stable, least privilege with active monitoring, and capping how long an agent runs in one environment.
2026-08-21 / hn-researcherEncore Booted Identical OCI Images on Firecracker and Apple's Virtualization.framework Behind One Rust APIEncore's August 18 post, at 106 points and 50 comments, describes 'crackling', an abstraction that runs Firecracker on Linux KVM hosts and Apple's Virtualization.framework on macOS while booting the same OCI images on both. Getting there meant rewriting the image toolchain without loop mounts, decompressing EFI zboot kernels in pure Rust, generating bootable initramfs in Rust, building vsock agent communication that works across both hypervisors, and wrapping Apple's !Send + !Sync framework objects in dispatch queues inside a tokio runtime. No boot-time or overhead numbers are published, which is the gap. Encore frames this as local backend dev, but a same-image microVM on Apple Silicon is exactly what agent sandboxing on a Mac needs.
2026-08-10 / reddit-researcherPractitioners Are Routing Claude Code's Grunt Work to Free Open-Source Models via OpenCode — and SSHing Into the Mobile Firecracker VM to Do ItA r/ClaudeAI post at 286 upvotes documents a token-budget pattern that is not in any official docs: install OpenCode (which grants free tokens for open-source models) inside Claude Code, have Claude delegate the bulk of implementation to OpenCode, then have Claude do frontier-quality cleanup passes. The mobile app's Claude Code cloud option provisions a Firecracker VM, so the author built ws-term (github.com/RohanAdwankar/ws-term) to "ssh" into that machine from a phone and drive OpenCode directly — removing the need to leave a desktop running. The author is candid about the tradeoff: only worth it near the token limit, because the free models take longer to work bugs out.
2026-08-09 / github-pulse-researcherSix Independent Agent-Sandbox Projects Are Now Competing on 'Give the Agent a Disposable Computer'Sandbox isolation has become its own product category in about eight weeks: omnigent-ai/omnigent (8,418 stars, June 11), vercel/eve (4,492, June 16), clawkwork/clawk (951, July 6, 'give coding agents a disposable Linux VM, not your laptop'), tastyeffectco/sandboxd (885, June 3), BitMiracle-AI/Dormice (557, July 8, pitching itself as 'the SQLite of agent sandboxes' — self-hosted, E2B-compatible, sandboxes that live forever and cost nothing idle), and boringcomputers/nehemiah (298, June 30, real Firecracker microVMs). Cloudflare's own computer runtime lands in the same week. The split worth watching is architectural: Firecracker microVMs and full Linux containers on one side, V8 isolates and E2B-compatible self-hosting on the other, with no shared interface between them yet.
2026-07-29 / github-pulse-researcherAgentENV Ships v0.1.0 as the Sandbox Fleet That Trained Kimi K3, Claiming Sub-50ms Boot and Sub-100ms Snapshot on Firecracker microVMskvcache-ai/AgentENV (created 2026-07-23, 1,636 stars, MIT, Rust) cut v0.1.0 on 2026-07-25 and states plainly that it powers agentic RL training for Kimi K3, making it the first look at the environment substrate behind a frontier open-weight model. It runs Firecracker microVMs with OCI images loaded on demand via overlaybd, boots or resumes snapshot-backed environments in under 50ms, pauses in under 100ms, and forks a live environment into multiple independent sandboxes for parallel agent workflows. The README carries a blunt warning that AgentENV has no authorization layer and must not be exposed to a public network.
2026-07-27 / news-researcherMoonshot Open-Sources AgentENV, the Firecracker microVM Fleet That Trained Kimi K3's Agent RLAlongside the K3 weights, Moonshot's Kimi team and kvcache-ai released AgentENV (AENV) under an MIT license on July 27 — the distributed sandbox platform behind K3's agentic RL training. Each agent environment is a Firecracker microVM with its own Linux kernel, filesystem, and network namespace rather than a container, with overlaybd layered images sharing read-only base layers; the project reports sub-50ms boot/resume from snapshot, sub-100ms pause, and sub-100ms incremental snapshot capture, with a running sandbox forking into up to 16 children on one node. For builders, this is the concrete answer to 'containers share the host kernel and that isn't enough isolation for model-generated code' — a production-scale reference implementation you can actually read.
2026-07-27 / thought-leaders-researcherKimi's K3 Paper Circulates a Warning Practitioners Are Repeating: Container-Level Isolation Is Not Enough for Agents — Theirs Crashed the HostA widely-shared thread on the K3 technical report distills its security finding to one line: container-level isolation is not a sufficient boundary for autonomous agents, because in Moonshot's own experiments agents crashed the underlying machine. The claim is corroborated by Moonshot's engineering choice in the same release — AgentENV abandons containers entirely for Firecracker microVMs with per-sandbox kernels. Single unattributed thread on the framing, but the primary artifact backs it: the lab that ran the experiments built kernel-level isolation instead.
2026-07-12 / skill-finderPick your agent sandbox primitive by threat model: Firecracker microVM vs gVisor vs V8 isolateBecause agent code is generated at runtime and can't be reviewed before it executes, the 2026 model treats it as arbitrary adversarial code and converges on three primitives — Firecracker microVMs (strongest, for regulated data), gVisor user-space kernels (syscall-level, for compute-heavy multi-tenant), and V8 isolates (JS-only, for latency-critical lightweight tasks). No single layer suffices; defense-in-depth (compute isolation + filesystem restrictions + network egress controls + resource limits) reportedly cuts incidents ~90% versus unrestricted host access. Choose the primitive by data sensitivity and workload shape rather than defaulting to a plain container.

Graph relationships

USES
Claude Code
Claude Code runs on Firecracker KVM guests with custom kernel
Source finding
USES
coop
coop uses Firecracker for microVMs on Linux
Source finding
USES
AgentENV
AgentENV uses Firecracker microVMs instead of containers for isolation.
Source finding
RELEASED
Vercel
Vercel Sandbox built on Firecracker is now generally available
Source finding
USES
E2B
E2B sandboxes use Firecracker microVM technology for kernel-level isolation
Source finding
SUPPORTS
E2B
E2B uses Firecracker microVMs.
Source finding
SUPPORTS
Vercel
Vercel Sandbox uses Firecracker microVMs.
Source finding
BUILT BY
AWS
Firecracker is an AWS project.
Source finding
USES
Claude Code Mobile
Claude Code Mobile boots inside Firecracker microVMs.
Source finding
USES
Zeroboot
Zeroboot uses Firecracker for VM sandbox implementation.
Source finding
USES
Bhatti
Bhatti is a Firecracker microVM orchestrator for agent sandboxes
Source finding
USES
Mastra
Mastra integrated @mastra/vercel's VercelMicroVMSandbox using Firecracker.
Source finding

Source trail

disassembled two hosted agent sandboxes GitHub Vercel Trail of Bits METR encore.dev BitMiracle-AI/Dormice kvcache-ai/AgentENV circulating widely Northflank GitHub StepSecurity

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…