Every AI agent gets its own Firecracker VM.
Each sandbox, agent box and Linux desktop runs in a Firecracker micro-VM with its own kernel, disk and network, not a shared container. It sleeps when idle and wakes in about a second, right where it left off.
What Firecracker is.A real VM, sized for one job.
Firecracker is an open-source virtual machine monitor built on Linux KVM. AWS built it to run Lambda functions. Each micro-VM boots its own guest kernel and gets a minimal set of virtual devices: a disk, a network card, a serial console. Little else is there to attack or to wait for.
Agents run code nobody has read.A container shares the kernel with it.
A model writes a script and runs it. A container keeps that script in a namespace on the host kernel. A micro-VM gives it a kernel of its own, behind hardware virtualization. And because a VM can be snapshotted whole, an agent can stop mid-task and pick up later without a restart.
| Container | Firecracker micro-VM | |
|---|---|---|
| Kernel | Shares the host kernel with every other container on the machine. | Boots its own guest kernel. The host exposes only a small set of virtual devices. |
| Isolation boundary | Namespaces and cgroups inside one kernel. | Hardware virtualization through KVM, with its own memory, disk and network. |
| Going idle | Stop the process, or keep paying for it to sit there. | Snapshot guest memory, vCPU registers and device state to disk. The VM process exits. |
| Coming back | Re-runs the entrypoint: interpreter boot, imports, reconnects, cold caches. | Maps the snapshot back and resumes at the instruction it paused on. |
One VM per machine.Nothing shared between customers.
Sandboxes, agent boxes and Linux desktops are Firecracker micro-VMs on bare metal. Windows desktops and Android phones need a full virtual machine, so each one gets its own. Every machine is billed per second, with no minimum. Delete one and its VM and disk are destroyed.
| Machine | Runs on | Price | When idle |
|---|---|---|---|
| Sandboxes | Firecracker micro-VM | $0.011 / hour per vCPU and 2 GB | Ends, and its disk is deleted with it. |
| Agent Boxes | Firecracker micro-VM | $1 / month per 2 GB | Sleeps with memory kept. Same monthly price, awake or asleep. |
| Linux Desktops | Firecracker micro-VM | $0.12 / hour | Sleeps after 5 idle minutes, open windows and all. Disk only. |
| Windows Desktops | Its own full VM | $0.18 / hour | Sleeps with memory kept and wakes in about a minute. Disk only. |
| Android Phones | Its own QEMU/KVM VM | $0.15 / hour | Sleeps when idle. Disk only. |
Asleep, a desktop or phone is billed for its disk alone. Full rates are on the pricing page.
Idle agents become a file.Then they pick up mid-task.
When a machine goes idle, Firecracker writes its memory, vCPU registers and device state to a snapshot on local NVMe, and the VM process exits. The host holds no memory and schedules no CPU for it. The next command, message, webhook or schedule maps the snapshot back, and the vCPUs resume at the instruction they paused on. Open processes and logins are still there.
0.5 s
Median cold boot of a new machine
288 boots, 1 Sep 2026 to 4 Sep 2026
0.6 s
Median wake, VM restored and running
3,378 wakes, 1 Sep 2026 to 4 Sep 2026
1.5 s
Median wake until the agent's services answer
14,771 wakes, 27 Aug 2026 to 4 Sep 2026
Medians from our production logs on one Firecracker host in Germany. Your workload may take longer to settle. A memory snapshot is kept for 7 days after the last action; after that, the next wake boots fresh from the same disk.
Firecracker on Maritime, briefly.
- What is a Firecracker micro-VM?
- Firecracker is an open-source virtual machine monitor built on Linux KVM. It starts small virtual machines, called micro-VMs, each with its own guest kernel and a minimal set of virtual devices. AWS built it to run Lambda functions.
- Is a micro-VM safer than a container for code an AI wrote?
- It puts a stronger wall around it. Code in a container talks to the same kernel as everything else on the host. Code in a micro-VM talks to its own kernel, behind hardware virtualization. On Maritime, nothing is shared between customers, and a sandbox is deleted with its disk when the task ends.
- Which Maritime machines run on Firecracker?
- Sandboxes, agent boxes and Linux desktops. Windows desktops and Android phones are each their own full virtual machine instead, with the same screen API, sleep and per-second billing.
- How fast does a sleeping machine wake?
- About a second. The VM itself is restored in a median of 0.6 seconds on our hosts, and the agent's services answer soon after. A Windows desktop takes about a minute. Your own workload may take longer to settle.
- Can I run code written for the E2B SDK?
- Yes. Code written for the stock E2B SDKs works against Maritime sandboxes. The sandboxes docs show how to point the SDK at Maritime.
More on isolation, data flow and compliance on the security page. Side by side with E2B and others on Compare.
Give your agent its own VM.One API key, one bill.
Start a sandbox from the dashboard, the CLI, the API or the E2B SDK.