AI agents have created a new kind of compute problem: how do you run code you did not write, safely? Agent-generated code, untrusted user submissions, per-session dev environments, one-off CI jobs - all of it needs a place to run where a mistake or a malicious payload cannot reach anything it should not. AWS Lambda MicroVMs are built for exactly this, and the Serverless Framework makes them genuinely easy to develop with.
A New Compute Primitive Built for Isolation
AWS Lambda MicroVMs are a brand new compute primitive, separate from Lambda Functions. Each one is a Firecracker virtual machine with its own kernel, running behind a hardware-enforced hypervisor boundary. That is far stronger isolation than a shared-kernel container, which is what makes MicroVMs the right place to run code you cannot fully trust.
A few properties make them a natural fit for agentic workloads:
- Full container workloads. A MicroVM runs a complete container image, so you bring the runtime, dependencies, and tools your code expects.
- Near-instant startup. MicroVMs boot from a snapshot, so a session is ready almost immediately instead of paying a cold-boot penalty.
- Suspend and resume for up to 8 hours. A MicroVM can pause with its memory and disk preserved, then resume right where it left off, for up to 8 hours of runtime. A single agent session can stop and pick back up later without losing state.
This is exactly why Anthropic uses Lambda MicroVMs to run Claude's agent tool calls: strong isolation for untrusted, model-generated code, plus long-lived sessions that hold state across many turns.
Sandboxes: MicroVMs in Your serverless.yml
The Serverless Framework brings MicroVMs into your serverless.yml as Sandboxes - a new top-level sandboxes property that sits alongside your functions. They are purpose-built for running code you did not write, safely:
- AI agents executing generated code
- Untrusted user code
- Per-session development environments
- Isolated CI jobs
Defining a sandbox takes only a few lines. The artifact is the only required field. From there, the Framework builds the image, provisions least-privilege IAM roles, wires up networking, and creates the log group and dashboard for you.
sandboxes:
agent:
artifact: ./agent # a directory with a Dockerfile
minimumMemory: 2048
environment:
MODEL: claude-sonnet-5
Deploy it with a single command:
serverless deploy
Develop Locally Against a Real MicroVMs Emulator
The part we are most excited about is the local development experience. serverless dev --sandbox starts a local, SDK-compatible MicroVMs emulator and runs your sandbox as an actual Docker container on your machine - the same image, byte-for-byte, that ships to production.
It is real Docker, real IAM, and instant edits:
- Edits to your source rebuild the image automatically.
- The container assumes the sandbox's real execution role through IAM emulation, so it reads Secrets Manager, S3, and everything else exactly as it will in the cloud.
- There is no per-VM cloud cost and no deploy-to-test loop.
serverless dev --sandbox agent
# starts a local MicroVMs emulator, e.g. http://127.0.0.1:9100
# point the AWS SDK/CLI at it with --endpoint-url
You build, test, and iterate on your machine, then deploy with confidence that production runs the same image.
Invoke and Tail Logs, in Dev or Production
The same commands work locally and in the cloud, so your workflow does not change between the two:
serverless invoke --sandbox agent --path /run
serverless logs --sandbox agent --startTime 30m
Lifecycle Hooks and Observability, Built In
Sandboxes can answer ready and run lifecycle hooks over a simple HTTP contract: ready is a build-time readiness gate, and run is a per-session dispatch signal.
Observability is on by default. Every deploy gets a CloudWatch log group, error metrics, and a dashboard. You can add warning filters and alarms directly in serverless.yml:
sandboxes:
agent:
artifact: ./agent
hooks:
ready: true
run: { timeout: 5 }
observability:
metrics:
filters:
errors: '%[Ee]rror|[Ee]xception%'
alarms:
thresholds:
errors: { threshold: 5, period: 300 }
Three Examples to Start From
All three deploy as-is from the Serverless examples repository:
- minimal - the smallest possible config: one sandbox, just an artifact, everything else on Framework defaults.
- complete - a full showcase: memory, environment variables, lifecycle hooks, observability, custom IAM, VPC egress, and tags.
- self-hosted-webhook - run each Claude Managed Agent session in its own throwaway MicroVM, launched on demand by a webhook.
Availability
AWS Lambda MicroVMs support is available in Serverless Framework v4.39.0. Upgrade with:
npm i -g serverless@latest
Read the full guide in the Sandboxes documentation.
The Serverless Framework is free for individuals and organizations under $2M in annual revenue. For larger teams, learn about our Subscription plans or schedule a meeting with us.