Ask HN: What is the best microVMs for AI agents?

6 days ago

Three weeks ago, we just launched an open-source computer-use agent: https://github.com/zfoong/WhiteCollarAgent

However, we are currently looking for self-hosted and easy-to-set-up microVM solutions for the agent's GUI mode. The idea is to let agents operate in an isolated environment for its GUI operation, like web-browsing, launching an app, and using the app, etc.

Anyone with any experience with microVM, feel free to let me know in the comments. Many thanks!

12 comments

zfoong

Reply
ammmir  5 days ago

I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor).

While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot the VM and save it as a "template". Then for every request, the snapshot was cloned (with some file system tricks like CoW) and resumed to handle the request. It "just" worked, but the orchestration was kludgy.

In the second incarnation of this, I decided to use Linux containers with the gVisor sandbox. You can take a look at my project https://github.com/ammmir/sandboxer which uses Podman and gVisor underneath; it's good enough for a prototype. Later on, you can swap it out with Firecracker microVM, if necessary. In fact, I'm thinking of adding microVM support to sandboxer itself. If you wanted to do it yourself, swap out ContainerEngine() with a new implementation based on calling out to Firecracker. You'll need some way to do disk volume management (grow, clone, shared, cross-machine? good luck!), snapshots, etc.

  • zfoong  5 days ago

    Thank you for your guidance! We were thinking about using Docker and eventually settled on Firecracker.

    Also, an interesting project you got there. If you are interested, would it be possible to invite you over to our project Discord? Would love to hear more of your experience.

Agent_Builder  5 days ago

We ran into this while building GTWY. MicroVMs helped with isolation, but most issues we saw weren’t about escape risk. They were about agents doing the wrong thing at the wrong step. Clear execution boundaries mattered more than stronger sandboxing in practice.

antonvs  6 days ago

Why a VM as opposed to just a container?

Containers are more flexible, especially in cloud environments. You can run containers on a cloud VM, or in a managed cloud cluster. Micro VMs can’t typically be used that way.

(I work at a SaaS that relies heavily on this model.)

  • zfoong  5 days ago

    We thought about using a container too. Easier to set up and everything. But it seems like microVMs give better isolation, and companies like Manus are also using Vms instead of containers.

    Any chance we can talk about this in detail?

    • antonvs  4 days ago

      Sure, happy to discuss in detail, here or in email (where we can arrange anything else.) Base64 decode the value in my profile a couple of times (sorry for the inconvenience.)

      Re isolation, my question would be, what's the threat model? Despite the theoretical risks, for example, cloud providers run user containers on their managed clusters and other service. Of course, those services and the containers they run are locked down in various ways, but that can be replicated if you're running on bare metal.

      Especially if you're going to be running in the cloud, microVMs will hurt you in terms of performance, because you'll be running your own VMs within the cloud provider VMs. Similarly, using microVMs makes it harder if not impractical to take advantage of orchestrators like Kubernetes.

      If you're running on bare metal, then it's probably not the best idea to run containers directly on e.g. an un-hardened Linux. You'd be better off running something like k8s for container management, and run that on a container-specific OS like Flatcar.

      In that scenario, I suppose the advantage of a microvm is mainly that it could help protect you from threats you may not have considered - after all, you and I aren't AWS or Google. But pragmatically, I think the disadvantages of micro VMs outweigh the largely theoretical risks.