Rohan Adwankar looks inside the VMs that Claude Code and Instinct run on your behalf

Rohan Adwankar published a technical write-up on 6 September that reports what he found by running commands inside the sandboxes Claude Code and Instinct use to execute code. The post surfaced on Hacker News with 56 points. Both platforms run on Firecracker microVMs, and the design choices on top of that shared floor are the interesting part.

Claude Code's sandbox

Adwankar reports that Claude Code boots each session into a Firecracker microVM with a custom-built guest kernel (6.18.5-fc-v20). At PID 1 Anthropic runs a Rust and Tokio binary called process_api, which mounts the disks and listens on vsock port 2024, so the host drives the session from outside the tenant. He describes this as the platform's defining trait: the operator lives inside the guest, and a lot of engineering goes into sealing it off. PID 1 is non-dumpable, /proc/1/mem is denied even with CAP_SYS_PTRACE, and the user shell lacks CAP_SYS_RESOURCE.

Disks split cleanly. The 256 GB vda is the user's, writable and persistent across reclaim. The read-only volumes hold what Anthropic supplies: a 324 MB compiled Bun binary at /opt/claude-code, a task launcher, and the skill packs. Inference goes out over Server-Sent Events on HTTPS/2 to /v1/messages through an egress gateway whose certificate names CN = Egress Gateway (production), with api.anthropic.com pinned in /etc/hosts. There is no inbound network at all. Adwankar measured the lifecycle from inside: 430 ms to init and 6.4 s to the harness process on a cold boot.

Instinct's sandbox

Instinct, a newer product, rents E2B sandboxes rather than running its own fleet. The hostname is e2b.local, systemd-detect-virt returns kvm, and the boot signature (pci=off, virtio-over-MMIO, empty DMI, tap networking) is Firecracker again. Ubuntu 22.04.5 boots with systemd and a full XFCE desktop in 1.258 seconds by Adwankar's timing. The agent's memory lives in a git repository of Markdown files at /memory, pushed to S3 as a single git bundle keyed by user id, with short-lived STS credentials rather than long-lived keys. The machine itself is throwaway, so the vault is the durable layer.

Where the model runs

The write-up notes that grepping the Instinct binaries for anthropic, openai, x-api-key or /v1/messages returns nothing: the sandbox holds no inference calls at all. Every tool call leaves as a GraphQL request to api.instinct.com and runs server-side. Claude Code seals the operator inside the guest and keeps the model behind an egress gateway; Instinct treats the sandbox as a pure execution surface that runs the bash its backend hands it, and holds all model and tool logic on its own servers.

A team building an agent product today has to pick between the two shapes Adwankar documents: a sealed guest that runs the harness locally in the tenant, or a rented execution surface with the coordination logic held back on the server. The first is harder to build and gives the user code that ran, verifiably, inside their own machine boundary. The second is faster to ship on someone else's fleet and moves the whole security surface to the platform's server APIs.

Source

The box an agent runs in, by Rohan Adwankar, discussed on Hacker News