Rohan Adwankar published the first in a series of detailed breakdowns of the virtual machines where mobile agents Claude Code (Anthropic) and Instinct run: both products are built on Firecracker microVMs, but Claude Code keeps a sealed harness in the guest with a persistent disk, while Instinct runs in a rented sandbox without a model, where memory is a git repository of Markdown that the agent commits itself.

image

What happened

In the report, the author describes from the inside the virtual machine where Claude Code runs. This is a Firecracker microVM with a custom guest kernel 6.18.5-fc-v20, where PID 1 is a sealed Rust/Tokio process process_api listening on vsock port 2024. A persistent writable disk vda of 256 GB survives restarts, while read-only disks carry the 324 MB Bun harness claude. Inference leaves the guest as an SSE stream over HTTPS/2 to /v1/messages only through a 443-only MITM egress gateway, where api.anthropic.com is pinned in /etc/hosts, and the measured boot time is about 430 ms to init and about 6.4 s to harness. The machine of the agent startup Instinct is a rented E2B sandbox: Ubuntu 22.04.5, 2 vCPU, 1.9 GB RAM, 29 GB, lifetime about 30 minutes, — also on Firecracker, but with full systemd and an XFCE desktop, which the system reaches in about 1.26 s. There is no model inside the box: all tool calls go out as GraphQL requests to the platform API, the agent's memory is a git repository of Markdown files with [[wiki-links]] that the agent itself commits and pushes to S3 as a single git-bundle, and on behalf of the user the agent acts through a rented server-side cloud Chrome with saved cookies and logs.

Context

The material is reverse-engineering of already working machines, not a release of a new product or model, and it opens a series of similar breakdowns published on the author's personal blog and picked up on Hacker News. The author entered the guest through his own ws-term terminal with network restrictions. Claude Code is an agent product of Anthropic, and Instinct is a new agent startup whose sandboxes are rented from E2B, an external service for one-time execution environments, inside which a regular systemd service envd is started. The common problem for both products is that the agent executes code, so the platforms isolate its work in microvirtual machines, and it is precisely the choice of Firecracker as an isolation primitive that becomes the common foundation on top of which fundamentally different memory and control architectures are built.

Why this matters for the industry

For the industry, the value of the report is that two real products are for the first time publicly compared in solving the same isolation and memory tasks. Two reproducible patterns are confirmed: a one-time Firecracker microVM as an execution layer plus durable state separated from the machine (a persistent virtual disk vda in Anthropic, a git repository of Markdown plus S3 in Instinct), and the principle of 'model outside the sandbox, execution inside'. The idea of memory as a git repository that the agent commits itself is a specific transparent alternative to RAG, where state is potentially portable between vendors. Server-side cloud Chrome with saved cookies shows how an agent can act on behalf of a user without receiving secrets on the machine. Specific numbers — kernel 6.18.5-fc-v20, vsock port 2024, boot times of about 430 ms, about 6.4 s, and about 1.26 s — become a reference for the latency budget when designing your own agent sandboxes. At the same time, the report does not contain pricing, SLA, or load data, so the conclusions should be considered an architectural reference, not a benchmark.

Why this matters for users

For the reader, the material is an opportunity to see what really happens under the hood when an agent lives in the cloud: specific kernels, ports, disk sizes, S3 paths, and GraphQL endpoints instead of abstractions. From the report, a practical checklist is formed for those who build their own agent backends: which primitives are laid into production (Firecracker, E2B, vsock, SSE/GraphQL, STS, S3, git-bundle) and which boot times are considered achievable (about 430 ms to init, about 6.4 s to harness, about 1.26 s to the graphical interface). The author opened the ws-term repository through which he entered the machines, so the described breakdown path can be reproduced and two approaches to isolation and memory can be compared on a live example. The material does not promise new model capabilities: its value is in the reference of working infrastructure.

What is still unknown / limitations

All measured times — about 430 ms, about 6.4 s, and about 1.26 s — are single observations without variance, sampling, or a public reproduction scenario. The report has no measurements of the effect of these architectures: there is no success rate of agent tasks, no quality of extraction from memory, no cost per task. This is reverse-engineering of already working machines, not a product release, and the reaction on Hacker News (3 points and 1 comment) does not indicate a market event. The described patterns should be verified by independent measurements before being borrowed into your own stack.

Sources

Author

Look at AI, editorial team