AI NewsInfrastructureReported
Rohan Adwankar looked inside the sandboxes two coding agents run in
A hands-on write-up published 6 September documents the sandbox both Claude Code and Instinct place their agents inside, and finds two different designs sitting on the same Firecracker microVM.
Why it mattersAnyone building an agent that runs code on a user's behalf faces the same choice these two teams made differently, and the write-up is the first public account of both designs side by side.
Rohan Adwankar published a technical write-up on 6 September that reports what he found by running commands inside the sandboxes Claude Code and Instinct use to execute code. The post appeared on Hacker News with 56 points. Both platforms run on Firecracker microVMs, and the design choices on top of that shared base are the interesting part.
Claude Code's sandbox
Adwankar reports that Claude Code boots each session into a Firecracker microVM with a custom-built guest kernel (6.18.5-fc-v20). At PID 1 Anthropic runs a Rust and Tokio binary called process_api, which mounts the disks and listens on vsock port 2024, so the host controls the session from outside the tenant. He describes this as the platform's main feature: the operator runs inside the guest, and a lot of engineering goes into isolating it. PID 1 is non-dumpable, /proc/1/mem is denied even with CAP_SYS_PTRACE, and the user shell lacks CAP_SYS_RESOURCE.
The disks are clearly separated. The 256 GB vda is the user's, writable and persistent across reclaim. The read-only volumes hold what Anthropic supplies: a 324 MB compiled Bun binary at /opt/claude-code, a task launcher, and the skill packs. Inference goes out over Server-Sent Events on HTTPS/2 to /v1/messages through an egress gateway whose certificate names CN = Egress Gateway (production), with api.anthropic.com pinned in /etc/hosts. There is no inbound network at all. Adwankar measured the lifecycle from inside: 430 ms to init and 6.4 s to the harness process on a cold boot.
Instinct's sandbox
Instinct, a newer product, rents E2B sandboxes rather than running its own servers. The hostname is e2b.local, systemd-detect-virt returns kvm, and the boot signature (pci=off, virtio-over-MMIO, empty DMI, tap networking) is Firecracker again. Ubuntu 22.04.5 boots with systemd and a full XFCE desktop in 1.258 seconds by Adwankar's timing. The agent's memory lives in a git repository of Markdown files at /memory, pushed to S3 as a single git bundle keyed by user id, with short-lived STS credentials rather than long-lived keys. The machine itself is temporary, so the stored repository is the part that lasts.
Where the model runs
The write-up notes that grepping the Instinct binaries for anthropic, openai, x-api-key or /v1/messages returns nothing: the sandbox holds no inference calls at all. Every tool call leaves as a GraphQL request to api.instinct.com and runs server-side. Claude Code isolates the operator inside the guest and keeps the model behind an egress gateway; Instinct treats the sandbox as a place that only runs the bash its backend sends it, and holds all model and tool logic on its own servers.
A team building an agent product today has to pick between the two designs Adwankar documents: an isolated guest that runs the harness locally in the tenant, or a rented execution environment with the coordination logic kept on the server. The first is harder to build and gives the user code that ran, verifiably, inside their own machine boundary. The second is faster to build on someone else's servers and moves all security concerns to the platform's server APIs.
Source
The box an agent runs in, by Rohan Adwankar, discussed on Hacker News
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
