The VMs Powering Mobile Agents (Instinct, Claude Code)

TL;DR Highlight

Peeking inside Claude Code and Instinct sandboxes: both Firecracker, with memory kept in git

Who Should Read

Backend developers designing cloud sandboxes for agents who need to decide where to run the harness and store memory

Core Mechanics

Both run on Firecracker microVMs
- Claude Code and Instinct both use KVM-based Firecracker microVMs (lightweight virtual machines).
- They differ in who runs the fleet and what boots inside.
Claude Code's harness lives inside the VM
- PID 1 is a Rust process_api, and the host controls the session over vsock port 2024.
- The 324 MB Bun harness sits on a read-only disk while inference goes out via SSE to /v1/messages.
Claude Code splits disks into yours and theirs
- vda at 256G is writable and survives reclaim.
- The harness, env-runner and skills are read-only shared disks, so chats feel continuous even though compute is destroyed.
Instinct rents E2B sandboxes
- The hostname is e2b.local, running Ubuntu 22.04 with 2 vCPU, 1.9 GB RAM, systemd and an XFCE desktop.
- Cold boot to a graphical desktop takes about 1.26s per systemd-analyze.
Instinct's memory is a git repo pushed to S3

Community Reactions

A question about how Firecracker was identified
- One commenter asked how the author determined E2B is Firecracker and not another microVM.
Surprise at how simple Instinct's memory is
- A commenter expected a database or graph but found just Markdown files in git.
A self-built alternative from a commenter
- One commenter said bespoke vs rented SaaS aren't the only options and promoted SlicerVM, built on Firecracker and Apple Virtualization framework.
A Firecracker learning pointer
- One commenter linked a post on cloning a running VM with the userfaultfd trick.

How to Apply

Start agent memory as a git folder
- Today, create a memory folder with entities, timeline and knowledge directories of Markdown with [[links]].
- Make the agent commit after each write and use grep for lookup.
Separate the sandbox from state storage
- Treat the sandbox as disposable and push memory to external storage like S3.
- Inject only short-lived STS credentials into the box.
Move tool calls server-side
- Keep only bash execution on the box and call tools like Gmail or payments through a backend API.
- Don't put secrets on the box; let a Vault-style service fill them.

Try It

copy & run

# Prompt to paste into Claude Code (simplified version of Instinct's memory structure from the article)

Let's create a ./memory folder in the current project as a git repo for agent memory.
Structure: entities/ comms/ timeline/ workstreams/ knowledge/
Rules:
- Put id, type, aliases frontmatter at the top of every file.
- Reference other files with [[id]] links.
- Overwrite entities and knowledge files as current state; write events only in timeline.
- Git commit after each task.

Record {{today's work summary}} following these rules and commit it.

Next to try: in a new session, make the agent grep for {{question keyword}} and answer from memory only

Terminology

Firecracker microVMA very lightweight virtual machine. It boots fast like a small container but has its own kernel, so isolation is stronger.

vsockA dedicated channel between host and VM. Think of it as an internal phone line that needs no network.

E2BA sandbox service that rents out disposable computers for agents.

STS credentialsTemporary AWS keys that expire. If leaked, they stop working after a while.

leaseA rental ticket for a cloud browser for one task. On release, cookies are saved for the next lease.