Moonshot open-sources the microVM fleet behind K3's agent training

Moonshot open-sourced AgentENV on July 27, the sandbox fleet it built to train K3's agent reinforcement learning. The lab needed it because containers weren't enough to contain its own agents. Moonshot's K3 technical report found the agents crashed host machines during training experiments.

AgentENV is MIT-licensed, and it's not a container runtime. Each agent environment runs as a Firecracker microVM, with its own Linux kernel, filesystem, and network namespace. It layers images with overlaybd, so machines can share read-only base layers without sharing a kernel.

AgentENV reports sub-50ms boot and resume from snapshot, plus sub-100ms pause and incremental snapshot capture. A running sandbox can fork into up to 16 children on a single node. That's fast enough to spin up an isolated environment per agent action, not just per session.

Containers share a kernel with the host by design, and that's the property that failed here. The code is MIT-licensed, so teams running agents in shared containers don't have to build kernel-level isolation from scratch to get it.