When you give an AI agent the ability to write and execute code, the security implications are significant. A container escape, a leaked environment variable, or an unintended network request can have real consequences. We took this seriously from day one.
Why not Docker?
Docker containers share a kernel with the host. While container isolation has improved significantly, the attack surface is still larger than we’re comfortable with for running untrusted AI-generated code. We needed stronger isolation guarantees.
Firecracker and E2B
Firecracker, created by AWS for Lambda, provides lightweight microVMs with a minimal attack surface. E2B wraps Firecracker with an excellent developer experience: fast boot times, snapshot-based cloning, and a clean SDK. Each agent session gets its own microVM that boots in under 200ms.
Defense in depth
Beyond the VM boundary, we layer additional controls: network policies that restrict outbound traffic, filesystem snapshots for rollback, resource limits that prevent runaway processes, and comprehensive audit logging of every system call. If an agent misbehaves, we catch it early and contain the blast radius.