Claude Code, Instinct run mobile agents in Firecracker VMs

HN user RohanAdwankar got shell access inside the cloud sandboxes that back two mobile/desktop-detached coding and personal agents, Claude Code and the newer startup Instinct, using a tool called ws-term, and published OS-level notes on how each one boots, isolates and persists a session: kernel command line, disk layout, PID 1, network configuration and where memory is stored.

Claude Code's mobile session runs in its own Firecracker microVM with its own kernel, booted straight into a custom init written in Rust and running on Tokio, not systemd: PID 1 is a binary called process_api, which also acts as the host's control agent inside the guest, listening on vsock port 2024 so the host can drive the session from outside. The disks split into a 256G writable, persistent volume (vda) that is the user's, and read-only volumes belonging to the platform: a 341M disk at /opt/claude-code holding the 324 MB compiled Bun harness that runs the tool calls, a 45.6M task launcher at /opt/env-runner, and further read-only volumes for skills. The model itself is not run in the guest: inference goes out as Server-Sent Events over HTTP/2 to /v1/messages, through an egress gateway that only allows port 443, MITMs the connection under a certificate reading "Egress Gateway ... (production)", and pins api.anthropic.com in /etc/hosts. There is no inbound connectivity at all, only the RFC-5737 test address 192.0.2.2, and auth to the model is a host-minted OAuth token cached root-only on disk and rotated on every boot. From inside the guest, init takes about 430 milliseconds and reaching the harness process takes about 6.4 seconds; when the host idle-reclaims a session, the processes are destroyed but the persistent disk detaches intact and reattaches on the next cold boot, which is why a conversation feels continuous even though the compute behind it was thrown away.

Instinct does not run its own VM fleet. Its sandboxes report hostname e2b.local, meaning it rents E2B's "sandbox-as-a-service": a throwaway Ubuntu 22.04.5 box with 2 vCPU, 1.9 GB RAM and 29 GB disk, running as an unprivileged user. Probing the kernel command line (pci=off, virtio-over-MMIO devices, an empty DMI table, tap0 networking) shows the E2B sandbox is also, under the hood, a Firecracker microVM, the same technology Claude Code uses. But where Claude Code boots a stripped custom init with a sealed PID 1, the E2B sandbox boots a full Ubuntu with systemd and a whole XFCE desktop, reaching graphical.target in about 1.26 seconds total (265ms kernel plus 992ms userspace). The operator-in-guest role here is filled by E2B's own envd running as an ordinary systemd service rather than a sealed PID 1.

Instinct's distinguishing idea is where an agent's memory lives once the box is thrown away: a directory at /memory containing a git repository of Markdown files linked with double-bracket wiki-links, organized into entities, comms, timeline, workstreams and knowledge, with the timeline coarsening over time from raw records up to weekly summaries. The agent itself is the git author of that repository, committing as "Instinct Agent agent@instinct.com": it writes Markdown and commits it directly rather than calling a memory API. The durable copy is that repository pushed to S3, keyed per user and stored as a single packed git bundle rather than loose files, authorized with short-lived STS credentials rather than long-lived keys, so that a leaked sandbox stops being useful once its token expires. Searching the strings in Instinct's own tools and agent-exec-server binaries for inference-related terms such as "anthropic", "openai", "/v1/messages" or a model name turned up nothing, leading the author to conclude the sandbox itself makes no inference calls: unlike Claude Code, which seals the model-calling operator inside the guest, Instinct's sandbox appears to be a pure execution surface, running whatever bash its backend sends and forwarding every tool call, from email to a cloud browser, as a server-side GraphQL request to api.instinct.com.

The write-up is the author's own informal notes from probing these sandboxes, not documentation published by Anthropic or by Instinct, and neither company is quoted or cited confirming any of it.

Key facts

Claude Code's cloud/mobile session runs in a Firecracker microVM booted into a custom Rust init (process_api, PID 1, not systemd); its disks split into a 256G writable persistent volume and read-only volumes holding a 324 MB Bun harness (341M disk) and a 45.6M task launcher.
Claude Code never runs inference in the guest: it goes out as SSE over HTTP/2 to /v1/messages through a 443-only, MITM'd egress gateway pinned to api.anthropic.com, with no inbound connectivity at all and a host-minted OAuth token rotated per boot.
Idle-reclaimed Claude Code sessions destroy the compute but detach the persistent disk intact for the next cold boot; from inside the guest, init takes about 430ms and reaching the harness process about 6.4s.
Instinct rents E2B "sandbox-as-a-service" Ubuntu boxes (2 vCPU, 1.9GB RAM, 29GB disk) that are themselves Firecracker microVMs, but boot a full Ubuntu with systemd and an XFCE desktop in about 1.26s, rather than a sealed custom init.
Instinct's persistent memory is a git repository of Markdown wiki-linked files under /memory, committed by the agent itself and pushed as a single bundle to per-user S3 storage via short-lived STS credentials; no inference-related strings were found in the sandbox binaries, suggesting model calls run server-side via GraphQL rather than inside the box.

Why it matters

The write-up is a rare outside look at how two different agent vendors solved the same problem, giving a customer's coding or personal-assistant agent a real, persistent-feeling computer to run on while keeping the model call and the customer's session isolated from each other. Claude Code seals the operator that talks to the model inside the guest itself and locks the guest down hard around it; Instinct keeps the model call entirely off the disposable box and instead makes an external, agent-authored git repository the durable thing. Both land on Firecracker microVMs underneath, which says something about where the industry has converged on lightweight VM isolation for agent sandboxes even when the platforms built on top of it differ completely.

Who it affects

Engineers building or evaluating similar mobile or cloud agent platforms, infrastructure and security people curious how vendors isolate a customer's live coding or assistant session from the host and from each other, and users of either product who want to know what actually happens to their session and their data once it leaves the phone or laptop screen.

How to use it

There is nothing to buy or configure here: it is an investigative sketch, not a product feature. The practical takeaway is the method itself, the specific commands the author ran inside a sandbox they already had shell access to (cat /proc/cmdline, ps -o comm -p 1, lsblk, systemd-analyze, checking for SMBIOS data) to work out what kind of VM they were in, who controls PID 1, and where state actually lives.

How solid is it

This is one developer's independent reverse engineering, based on shell access inside these sandboxes via a tool called ws-term, not documentation published or confirmed by Anthropic or by Instinct. The specific command outputs quoted, kernel version strings, disk sizes, network addresses, systemd timings, are concrete and checkable in principle, but the interpretation (what process_api does, why the egress gateway MITMs traffic, that Instinct makes no inference calls from inside the box) is the author's inference from what those artifacts show, not a confirmed architecture from either company.

Risks and caveats

The source names no official documentation corroborating any of this. It gives no pricing or plan-tier information for either platform, and no company, funding or founder detail about Instinct beyond calling it a new, recently launched startup. The claim that Instinct makes no inference calls inside the sandbox rests on finding no matching strings in two binaries, an absence that does not by itself rule out other mechanisms. The post carries no explicit publication date; the only dated artifact seen is a memory-vault file from inside the Instinct sandbox, which is not the same as when the write-up itself went up.

“That's the platform's defining trait: the operator lives inside your tenant space, and a lot of engineering goes into sealing it off”

— RohanAdwankar, describing Claude Code's sandbox architecture