The story that Claude Managed Agents' cloud sandbox execution environment runs on Firecracker
The cloud sandbox of Claude Managed Agents appeared to be running on Firecracker MicroVMs.
2026.09.16
This page has been translated by machine translation. View original
This is Iwata from the Retail App Co-creation Division @ Osaka.
The other day, I tried launching a self-hosted sandbox for Claude Managed Agents on Lambda MicroVMs.
After that, what caught my curiosity was: what kind of environment is the normal cloud sandbox managed by Anthropic running on?
The official documentation introduces cloud sandboxes as follows:
Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure. They come pre-installed with a comprehensive set of programming languages, databases, and utilities. The agent can use these immediately without any installation steps.
It says they run as isolated Linux containers on Anthropic-managed infrastructure, but what specific technologies are being used? I tried to verify this to the extent possible.
Disclaimer
Let's Try It
Let's go ahead and check this out.
From here on, I'll be asking Claude Console to execute various OS commands using the Bash tool, and investigate what kind of environment the Bash tool is running in.
uname -a
First, here are the results of running uname -a.
Linux vm 6.18.44-fc-v33 #1 SMP PREEMPT_DYNAMIC @0 x86_64 x86_64 x86_64 GNU/Linux
Hmm...? What on earth is fc-v33?!
※ By the way, when I checked a few days before writing this blog post, it was fc-v24
cat /proc/cmdline
Next, I ran cat /proc/cmdline. The results were as follows.
※ Line breaks added for readability.
deferred_init=lazy dhash_entries=131072 ihash_entries=65536 console=ttyS0 reboot=k panic=1
nomodule random.trust_cpu=1 ipv6.disable=1 swiotlb=noforce psi=1 rdinit=/
process_api -- --firecracker-init --addr 0.0.0.0:2024 --max-ws-buffer-size 32768
--block-local-connections --listen-vsock-port 2024 --log-vsock-port 5002
The option --firecracker-init is specified in there. Could this mean that the sandbox is running on a Firecracker MicroVM??
dmesg
Now let's run dmesg. The results are as follows, and in addition to the kernel arguments we confirmed earlier, we were able to find various other interesting information.
dmesg results
[ 0.000000] Linux version 6.18.44-fc-v33 (builder@sandboxing) (gcc (GCC) 15.3.0, GNU ld (GNU Binutils) 2.46) #1 SMP PREEMPT_DYNAMIC @0
[ 0.000000] Command line: deferred_init=lazy dhash_entries=131072 ihash_entries=65536 console=ttyS0 reboot=k panic=1 nomodule random.trust_cpu=1 ipv6.disable=1 swiotlb=noforce psi=1 rdinit=/process_api -- --firecracker-init --addr 0.0.0.0:2024 --max-ws-buffer-size 32768 --block-local-connections --listen-vsock-port 2024 --log-vsock-port 5002
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x00000000000fffff] reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bfffffff] usable
[ 0.000000] BIOS-e820: [mem 0x00000000eec00000-0x00000000febfffff] reserved
[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000043fffffff] usable
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] APIC: Static calls initialized
[ 0.000000] DMI not present or invalid.
[ 0.000000] Hypervisor detected: KVM
[ 0.000000] last_pfn = 0xc0000 max_arch_pfn = 0x400000000
[ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00
[ 0.000001] kvm-clock: using sched offset of 77378013 cycles
[ 0.000003] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
[ 0.000105] tsc: Detected 2799.998 MHz processor
[ 0.001202] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved
[ 0.001205] e820: remove [mem 0x000a0000-0x000fffff] usable
[ 0.001209] last_pfn = 0x440000 max_arch_pfn = 0x400000000
[ 0.001688] MTRR map: 0 entries (0 fixed + 0 variable; max 16), built from 8 variable MTRRs
[ 0.001824] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT
[ 0.002465] last_pfn = 0xc0000 max_arch_pfn = 0x400000000
[ 0.002601] Using GB pages for direct mapping
[ 0.002918] RAMDISK: [mem 0xbf4a4000-0xbfffffff]
[ 0.003038] ACPI: Early table checksum verification disabled
[ 0.003334] ACPI: RSDP 0x00000000000E0000 000024 (v02 FIRECK)
[ 0.003454] ACPI: XSDT 0x00000000000A0F35 00003C (v01 FIRECK FCMVXSDT 00000000 FCAT 20240119)
[ 0.003572] ACPI: FACP 0x00000000000A0D8D 000114 (v06 FIRECK FCVMFADT 00000000 FCAT 20240119)
[ 0.003654] ACPI: DSDT 0x000000000009FD6C 001021 (v02 FIRECK FCVMDSDT 00000000 FCAT 20240119)
[ 0.003659] ACPI: APIC 0x00000000000A0EA1 000058 (v06 FIRECK FCVMMADT 00000000 FCAT 20240119)
[ 0.003663] ACPI: MCFG 0x00000000000A0EF9 00003C (v01 FIRECK FCMVMCFG 00000000 FCAT 20240119)
[ 0.003667] ACPI: Reserving FACP table memory at [mem 0xa0d8d-0xa0ea0]
[ 0.003669] ACPI: Reserving DSDT table memory at [mem 0x9fd6c-0xa0d8c]
[ 0.003670] ACPI: Reserving APIC table memory at [mem 0xa0ea1-0xa0ef8]
[ 0.003671] ACPI: Reserving MCFG table memory at [mem 0xa0ef9-0xa0f34]
[ 0.006615] No NUMA configuration found
[ 0.006617] Faking a node at [mem 0x0000000000000000-0x000000043fffffff]
[ 0.006646] NODE_DATA(0) allocated [mem 0x43ffde3c0-0x43fffffff]
[ 0.008129] Zone ranges:
[ 0.008179] DMA [mem 0x0000000000001000-0x0000000000ffffff]
[ 0.008206] DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
[ 0.008232] Normal [mem 0x0000000100000000-0x000000043fffffff]
[ 0.008258] Movable zone start for each node
[ 0.008284] Early memory node ranges
[ 0.008285] node 0: [mem 0x0000000000001000-0x000000000009efff]
[ 0.008286] node 0: [mem 0x0000000000100000-0x00000000bfffffff]
[ 0.008288] node 0: [mem 0x0000000100000000-0x000000043fffffff]
[ 0.008290] Initmem setup node 0 [mem 0x0000000000001000-0x000000043fffffff]
[ 0.008479] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.009798] On node 0, zone DMA: 97 pages in unavailable ranges
[ 0.286676] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
[ 0.286705] ACPI: Using ACPI (MADT) for SMP configuration information
[ 0.286729] TSC deadline timer available
[ 0.286733] CPU topo: Max. logical packages: 1
[ 0.286754] CPU topo: Max. logical dies: 1
[ 0.286754] CPU topo: Max. dies per package: 1
[ 0.286757] CPU topo: Max. threads per core: 1
[ 0.286758] CPU topo: Num. cores per package: 4
[ 0.286759] CPU topo: Num. threads per package: 4
[ 0.286759] CPU topo: Allowing 4 present CPUs plus 0 hotplug CPUs
[ 0.286893] kvm-guest: APIC: eoi() replaced with kvm_guest_apic_eoi_write()
[ 0.287183] kvm-guest: KVM setup pv remote TLB flush
[ 0.287222] kvm-guest: setup PV sched yield
[ 0.287371] [mem 0xc0000000-0xeebfffff] available for PCI devices
[ 0.287373] Booting paravirtualized kernel on KVM
[ 0.287375] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
[ 0.287474] Kernel is locked down from Kernel configuration; see man kernel_lockdown.7
[ 0.287612] setup_percpu: NR_CPUS:256 nr_cpumask_bits:4 nr_cpu_ids:4 nr_node_ids:1
[ 0.298992] percpu: Embedded 52 pages/cpu s183320 r0 d29672 u524288
[ 0.299043] pcpu-alloc: s183320 r0 d29672 u524288 alloc=1*2097152
[ 0.299046] pcpu-alloc: [0] 0 1 2 3
[ 0.299222] kvm-guest: PV spinlocks enabled
[ 0.299245] PV qspinlock hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.299268] Kernel command line: deferred_init=lazy dhash_entries=131072 ihash_entries=65536 console=ttyS0 reboot=k panic=1 nomodule random.trust_cpu=1 ipv6.disable=1 swiotlb=noforce psi=1 rdinit=/process_api -- --firecracker-init --addr 0.0.0.0:2024 --max-ws-buffer-size 32768 --block-local-connections --listen-vsock-port 2024 --log-vsock-port 5002
[ 0.300663] random: crng init done
[ 0.300665] printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
[ 0.305975] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.309537] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.309839] Fallback order for Node 0: 0
[ 0.309906] Built 1 zonelists, mobility grouping on. Total pages: 4194206
[ 0.309908] Policy zone: Normal
[ 0.309910] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.341002] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.394557] ftrace: allocating 44286 entries in 176 pages
[ 0.394580] ftrace: allocated 176 pages with 3 groups
[ 0.396767] Dynamic Preempt: none
[ 0.397261] rcu: Preemptible hierarchical RCU implementation.
[ 0.397310] rcu: RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=4.
[ 0.397312] Trampoline variant of Tasks RCU enabled.
[ 0.397334] Rude variant of Tasks RCU enabled.
[ 0.397335] Tracing variant of Tasks RCU enabled.
[ 0.397336] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.397337] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[ 0.397404] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.397406] RCU Tasks Rude: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.397408] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.409526] NR_IRQS: 16640, nr_irqs: 440, preallocated irqs: 0
[ 0.409666] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.409686] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.409882] Console: colour dummy device 80x25
[ 0.410123] printk: legacy console [ttyS0] enabled
[ 0.766773] ACPI: Core revision 20250807
[ 0.769048] APIC: Switch to symmetric I/O mode setup
[ 0.773210] x2apic enabled
[ 0.776191] APIC: Switched APIC routing to: physical x2apic
[ 0.779204] kvm-guest: APIC: send_IPI_mask() replaced with kvm_send_ipi_mask()
[ 0.783122] kvm-guest: APIC: send_IPI_mask_allbutself() replaced with kvm_send_ipi_mask_allbutself()
[ 0.788055] kvm-guest: setup PV IPIs
[ 0.790556] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x285c3ee517e, max_idle_ns: 440795257231 ns
[ 0.796170] Calibrating delay loop (skipped) preset value.. 5599.99 BogoMIPS (lpj=11199992)
[ 0.800165] x86/cpu: User Mode Instruction Prevention (UMIP) activated
[ 0.800165] Last level iTLB entries: 4KB 64, 2MB 8, 4MB 8
[ 0.800165] Last level dTLB entries: 4KB 64, 2MB 32, 4MB 32, 1GB 4
[ 0.800165] mitigations: Enabled attack vectors: user_kernel, user_user, SMT mitigations: auto
[ 0.800165] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[ 0.800165] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.800165] RETBleed: Mitigation: Enhanced IBRS
[ 0.800165] ITS: Mitigation: Aligned branch/return thunks
[ 0.800165] TAA: Vulnerable: Clear CPU buffers attempted, no microcode
[ 0.800165] MMIO Stale Data: Vulnerable: Clear CPU buffers attempted, no microcode
[ 0.800165] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 0.800165] Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT
[ 0.800165] Spectre V2 : Enabling IBPB for BPF
[ 0.800165] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 0.800165] active return thunk: its_return_thunk
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
[ 0.800165] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
[ 0.800165] x86/fpu: xstate_offset[5]: 832, xstate_sizes[5]: 64
[ 0.800165] x86/fpu: xstate_offset[6]: 896, xstate_sizes[6]: 512
[ 0.800165] x86/fpu: xstate_offset[7]: 1408, xstate_sizes[7]: 1024
[ 0.800165] x86/fpu: Enabled xstate features 0xe7, context size is 2432 bytes, using 'compacted' format.
[ 0.800165] Freeing SMP alternatives memory: 44K
[ 0.800165] pid_max: default: 32768 minimum: 301
[ 0.800165] LSM: initializing lsm=lockdown,capability,landlock,selinux
[ 0.800165] landlock: Up and running.
[ 0.800165] SELinux: Initializing.
[ 0.800165] Mount-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.800165] Mountpoint-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.800165] smpboot: CPU0: Intel(R) Xeon(R) Processor @ 2.80GHz (family: 0x6, model: 0x55, stepping: 0x7)
[ 0.801589] Performance Events: unsupported CPU family 6 model 85 no PMU driver, software events only.
[ 0.804413] signal: max sigframe size: 3632
[ 0.806653] pvm-pv: not detected, 0/45 sites patched
[ 0.808293] rcu: Hierarchical SRCU implementation.
[ 0.810728] rcu: Max phase no-delay instances is 1000.
[ 0.812803] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 0.816799] NMI watchdog: Perf NMI watchdog permanently disabled
[ 0.820377] smp: Bringing up secondary CPUs ...
[ 0.823585] smpboot: x86: Booting SMP configuration:
[ 0.824180] .... node #0, CPUs: #1 #2 #3
[ 0.832289] smp: Brought up 1 node, 4 CPUs
[ 0.838478] smpboot: Total of 4 processors activated (22399.98 BogoMIPS)
[ 0.841992] deferred_init=lazy: 3308913 pages left to deferred_grow_zone()
[ 0.844183] Memory: 3224216K/16776824K available (15877K kernel code, 2035K rwdata, 8712K rodata, 3540K init, 2456K bss, 311808K reserved, 0K cma-reserved)
[ 0.848974] devtmpfs: initialized
[ 0.850074] x86/mm: Memory block size: 128MB
[ 0.856303] posixtimers hash table entries: 2048 (order: 3, 32768 bytes, linear)
[ 0.860643] futex hash table entries: 1024 (65536 bytes on 1 NUMA nodes, total 64 KiB, linear).
[ 0.875081] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.876259] audit: initializing netlink subsys (disabled)
[ 0.879029] audit: type=2000 audit(1789434532.867:1): state=initialized audit_enabled=0 res=1
[ 0.879029] thermal_sys: Registered thermal governor 'fair_share'
[ 0.880179] thermal_sys: Registered thermal governor 'step_wise'
[ 0.883254] thermal_sys: Registered thermal governor 'user_space'
[ 0.884205] cpuidle: using governor ladder
[ 0.888197] cpuidle: using governor menu
[ 0.890888] PCI: ECAM [mem 0xeec00000-0xeecfffff] (base 0xeec00000) for domain 0000 [bus 00-00]
[ 0.892182] PCI: ECAM [mem 0xeec00000-0xeecfffff] reserved as E820 entry
[ 0.895655] PCI: Using configuration type 1 for base access
[ 0.897138] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[ 0.900181] HugeTLB: 16380 KiB vmemmap can be freed for a 1.00 GiB page
[ 0.903515] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.904177] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.910608] ACPI: Added _OSI(Module Device)
[ 0.912179] ACPI: Added _OSI(Processor Device)
[ 0.914447] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.916620] ACPI: 1 ACPI AML tables successfully acquired and loaded
[ 0.920238] ACPI: Interpreter enabled
[ 0.922144] ACPI: PM: (supports S0)
[ 0.924178] ACPI: Using IOAPIC for interrupt routing
[ 0.926746] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 0.928177] PCI: Using E820 reservations for host bridge windows
[ 0.933487] ACPI: PCI Root Bridge [PC00] (domain 0000 [bus 00])
[ 0.936184] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3]
[ 0.940178] acpi PNP0A08:00: PCIe port services disabled; not requesting _OSC control
[ 0.944134] acpi PNP0A08:00: _OSC: platform retains control of PCIe features (AE_NOT_FOUND)
[ 0.944329] PCI host bridge to bus 0000:00
[ 0.946447] pci_bus 0000:00: root bus resource [mem 0xeec00000-0xeecfffff]
[ 0.948180] pci_bus 0000:00: root bus resource [mem 0xc0001000-0xeebfffff window]
[ 0.952034] pci_bus 0000:00: root bus resource [mem 0x4000000000-0x7fffffffff window]
[ 0.952181] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 0.955598] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 0.956181] pci_bus 0000:00: root bus resource [bus 00]
[ 0.959216] pci 0000:00:00.0: [8086:0d57] type 00 class 0x060000 conventional PCI endpoint
[ 0.963469] pci 0000:00:01.0: [1af4:1045] type 00 class 0xffff00 conventional PCI endpoint
[ 0.965686] pci 0000:00:01.0: BAR 0 [mem 0x4000000000-0x400007ffff 64bit]
[ 0.972123] pci 0000:00:02.0: [1af4:1042] type 00 class 0x018000 conventional PCI endpoint
[ 0.973662] pci 0000:00:02.0: BAR 0 [mem 0x4000080000-0x40000fffff 64bit]
[ 0.980150] pci 0000:00:03.0: [1af4:1042] type 00 class 0x018000 conventional PCI endpoint
[ 0.981654] pci 0000:00:03.0: BAR 0 [mem 0x4000100000-0x400017ffff 64bit]
[ 0.988157] pci 0000:00:04.0: [1af4:1041] type 00 class 0x020000 conventional PCI endpoint
[ 0.989649] pci 0000:00:04.0: BAR 0 [mem 0x4000180000-0x40001fffff 64bit]
[ 0.996110] pci 0000:00:05.0: [1af4:1053] type 00 class 0xffff00 conventional PCI endpoint
[ 0.997668] pci 0000:00:05.0: BAR 0 [mem 0x4000200000-0x400027ffff 64bit]
[ 1.004126] pci 0000:00:06.0: [1af4:1044] type 00 class 0xffff00 conventional PCI endpoint
[ 1.005663] pci 0000:00:06.0: BAR 0 [mem 0x4000280000-0x40002fffff 64bit]
[ 1.019151] iommu: Default domain type: Translated
[ 1.020178] iommu: DMA domain TLB invalidation policy: lazy mode
[ 1.023263] pps_core: LinuxPPS API ver. 1 registered
[ 1.024178] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 1.028252] PTP clock support registered
[ 1.031220] NetLabel: Initializing
[ 1.032180] NetLabel: domain hash size = 128
[ 1.034454] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 1.036214] NetLabel: unlabeled traffic allowed by default
[ 1.039017] PCI: Using ACPI for IRQ routing
[ 1.040178] PCI: pci_cache_line_size set to 64 bytes
[ 1.040785] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff]
[ 1.040831] vgaarb: loaded
[ 1.041626] clocksource: Switched to clocksource kvm-clock
[ 1.045060] VFS: Disk quotas dquot_6.6.0
[ 1.047233] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 1.051437] pnp: PnP ACPI init
[ 1.053410] pnp: PnP ACPI: found 5 devices
[ 1.061186] NET: Registered PF_INET protocol family
[ 1.073728] IP idents hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 1.123113] tcp_listen_portaddr_hash hash table entries: 8192 (order: 5, 131072 bytes, linear)
[ 1.127612] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 1.131556] TCP established hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 1.140489] TCP bind hash table entries: 65536 (order: 9, 2097152 bytes, linear)
[ 1.155012] TCP: Hash tables configured (established 131072 bind 65536)
[ 1.159015] MPTCP token hash table entries: 16384 (order: 7, 393216 bytes, linear)
[ 1.163010] UDP hash table entries: 8192 (order: 7, 524288 bytes, linear)
[ 1.169359] UDP-Lite hash table entries: 8192 (order: 7, 524288 bytes, linear)
[ 1.175619] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 1.178643] NET: Registered PF_XDP protocol family
[ 1.181135] pci_bus 0000:00: resource 4 [mem 0xeec00000-0xeecfffff]
[ 1.184336] pci_bus 0000:00: resource 5 [mem 0xc0001000-0xeebfffff window]
[ 1.187829] pci_bus 0000:00: resource 6 [mem 0x4000000000-0x7fffffffff window]
[ 1.191646] pci_bus 0000:00: resource 7 [io 0x0000-0x0cf7 window]
[ 1.194889] pci_bus 0000:00: resource 8 [io 0x0d00-0xffff window]
[ 1.198384] PCI: CLS 0 bytes, default 64
[ 1.200498] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 1.201012] Unpacking initramfs...
[ 1.203874] software IO TLB: No low mem
[ 1.207964] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 1.212474] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x285c3ee517e, max_idle_ns: 440795257231 ns
[ 1.217849] clocksource: Switched to clocksource tsc
[ 1.220727] platform rtc_cmos: registered platform RTC device (no PNP device found)
[ 1.231648] Initialise system trusted keyrings
[ 1.233959] Key type blacklist registered
[ 1.236338] workingset: timestamp_bits=36 max_order=22 bucket_order=0
[ 1.240120] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.246558] fuse: init (API version 7.45)
[ 1.258726] Key type asymmetric registered
[ 1.260821] Asymmetric key parser 'x509' registered
[ 1.263615] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 1.267769] io scheduler mq-deadline registered
[ 1.270160] io scheduler kyber registered
[ 1.273386] io scheduler bfq registered
[ 1.277076] virtio-pci 0000:00:01.0: enabling device (0000 -> 0002)
[ 1.283191] virtio-pci 0000:00:02.0: enabling device (0000 -> 0002)
[ 1.289264] virtio-pci 0000:00:03.0: enabling device (0000 -> 0002)
[ 1.295321] virtio-pci 0000:00:04.0: enabling device (0000 -> 0002)
[ 1.301369] virtio-pci 0000:00:05.0: enabling device (0000 -> 0002)
[ 1.307599] virtio-pci 0000:00:06.0: enabling device (0000 -> 0002)
[ 1.319407] Free page reporting enabled
[ 1.321881] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 1.325665] 00:00: ttyS0 at I/O 0x3f8 (irq = 26, base_baud = 115200) is a 16550A
[ 1.325895] Freeing initrd memory: 11632K
[ 1.343794] loop: module loaded
[ 1.345992] virtio_blk virtio1: 1/0/0 default/read/poll queues
[ 1.351771] virtio_blk virtio1: [vda] 536870912 512-byte logical blocks (275 GB/256 GiB)
[ 1.358516] virtio_blk virtio2: 1/0/0 default/read/poll queues
[ 1.364203] virtio_blk virtio2: [vdb] 536870912 512-byte logical blocks (275 GB/256 GiB)
[ 1.370008] zram: Added device: zram0
[ 1.372688] tun: Universal TUN/TAP device driver, 1.6
[ 1.379682] intel_pstate: CPU model not supported
[ 1.382132] hid: raw HID events driver (C) Jiri Kosina
[ 1.385000] Mirror/redirect action on
[ 1.386990] u32 classifier
[ 1.388422] input device check on
[ 1.390306] Actions configured
[ 1.412500] xt_time: kernel timezone is -0000
[ 1.414934] Initializing XFRM netlink socket
[ 1.417128] IPv6: Loaded, but administratively disabled, reboot required to enable
[ 1.421159] NET: Registered PF_PACKET protocol family
[ 1.423752] Bridge firewalling registered
[ 1.426339] Key type dns_resolver registered
[ 1.428691] NET: Registered PF_VSOCK protocol family
[ 1.441270] IPI shorthand broadcast: enabled
[ 1.445796] sched_clock: Marking stable (1057035267, 386480423)->(1691338562, -247822872)
[ 1.450567] registered taskstats version 1
[ 1.459051] Loading compiled-in X.509 certificates
[ 1.468243] Demotion targets for Node 0: null
[ 1.470657] Key type .fscrypt registered
[ 1.472645] Key type fscrypt-provisioning registered
[ 1.475952] Key type encrypted registered
[ 1.481292] clk: Disabling unused clocks
[ 1.501850] Freeing unused kernel image (initmem) memory: 3540K
[ 1.503676] Write protecting the kernel read-only data: 26624k
[ 1.507839] Freeing unused kernel image (text/rodata gap) memory: 504K
[ 1.517359] Freeing unused kernel image (rodata/data gap) memory: 1528K
[ 1.519341] Run /process_api as init process
[ 1.520619] with arguments:
[ 1.520620] /process_api
[ 1.520621] --firecracker-init
[ 1.520621] --addr
[ 1.520622] 0.0.0.0:2024
[ 1.520623] --max-ws-buffer-size
[ 1.520623] 32768
[ 1.520624] --block-local-connections
[ 1.520625] --listen-vsock-port
[ 1.520625] 2024
[ 1.520626] --log-vsock-port
[ 1.520626] 5002
[ 1.520627] with environment:
[ 1.520627] HOME=/
[ 1.520628] TERM=linux
[ 2.851189] virtio_blk virtio2: [vdb] new size: 19600 512-byte logical blocks (10.0 MB/9.57 MiB)
[ 2.851202] random: crng reseeded due to virtual machine fork
[ 2.851523] virtio_blk virtio1: [vda] new size: 536870912 512-byte logical blocks (275 GB/256 GiB)
[ 2.853658] vdb: detected capacity change from 536870912 to 19600
[ 2.870751] tokio-rt-worker (71): drop_caches: 3
[ 2.874130] EXT4-fs (vda): warning: mounting unchecked fs, running e2fsck is recommended
[ 2.878348] EXT4-fs (vda): mounted filesystem 2c47d290-c9ae-4956-8d3e-4780b8c56ff8 r/w without journal. Quota mode: none.
First, from the output Hypervisor detected: KVM, we can determine that the sandbox environment is running on a KVM virtual machine.
Next, from the following output, we can see that Firecracker is being used for device virtualization.
[ 0.003334] ACPI: RSDP 0x00000000000E0000 000024 (v02 FIRECK)
[ 0.003454] ACPI: XSDT 0x00000000000A0F35 00003C (v01 FIRECK FCMVXSDT 00000000 FCAT 20240119)
[ 0.003572] ACPI: FACP 0x00000000000A0D8D 000114 (v06 FIRECK FCVMFADT 00000000 FCAT 20240119)
[ 0.003654] ACPI: DSDT 0x000000000009FD6C 001021 (v02 FIRECK FCVMDSDT 00000000 FCAT 20240119)
[ 0.003659] ACPI: APIC 0x00000000000A0EA1 000058 (v06 FIRECK FCVMMADT 00000000 FCAT 20240119)
[ 0.003663] ACPI: MCFG 0x00000000000A0EF9 00003C (v01 FIRECK FCMVMCFG 00000000 FCAT 20240119)
The string FIRECK is defined here.
Also, FCMVXSDT is defined here
And FCVMFADT is defined here.
I also found the following output as another interesting point.
random: crng reseeded due to virtual machine fork
This strongly suggests that the environment is being restored from a Firecracker snapshot. Incidentally, this message was defined here in the Linux kernel.
findmnt
Next, I ran findmnt. The results were as follows.
TARGET SOURCE FSTYPE OPTIONS
/ /dev/vda ext4 rw,relatime,resv_strict,resuid=65534,resgid=65534
|-/proc proc proc rw,relatime
|-/sys sysfs sysfs rw,relatime
| `-/sys/fs/cgroup tmpfs tmpfs rw,relatime,mode=755
| |-/sys/fs/cgroup/cpu cgroup cgroup rw,relatime,cpu
| |-/sys/fs/cgroup/cpuacct cgroup cgroup rw,relatime,cpuacct
| |-/sys/fs/cgroup/cpuset cgroup cgroup rw,relatime,cpuset
| |-/sys/fs/cgroup/memory cgroup cgroup rw,relatime,memory
| |-/sys/fs/cgroup/devices cgroup cgroup rw,relatime,devices
| |-/sys/fs/cgroup/freezer cgroup cgroup rw,relatime,freezer
| |-/sys/fs/cgroup/blkio cgroup cgroup rw,relatime,blkio
| |-/sys/fs/cgroup/pids cgroup cgroup rw,relatime,pids
| |-/sys/fs/cgroup/systemd cgroup cgroup rw,relatime,name=systemd
| `-/sys/fs/cgroup/unified cgroup2 cgroup2 rw,relatime
|-/dev devtmpfs devtmpfs rw,relatime,size=8232508k,nr_inodes=2058127,mode=755
| |-/dev/shm tmpfs tmpfs rw,relatime,size=16482220k
| | `-/dev/shm tmpfs tmpfs rw,relatime,size=16482220k
| `-/dev/pts devpts devpts rw,relatime,mode=600,ptmxmode=000
| `-/dev/pts devpts devpts rw,relatime,mode=600,ptmxmode=000
|-/opt/rclone /dev/vdb squashfs ro,relatime,errors=continue
|-/mnt/sandboxing/model_tools_env/v1/python model_tools_unavailable tmpfs ro,nosuid,nodev,relatime,size=4k,mode=755
|-/run/sandbox-telemetry tmpfs tmpfs rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755,uid=64321,gid=64321
|-/mnt/skills rclone-filestore:sesn_01GSzPZ4xRq3rg7Dioky6LYb:/mnt/skills fuse.rclone ro,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,max_read=1048576
|-/mnt/session/uploads rclone-filestore:sesn_01GSzPZ4xRq3rg7Dioky6LYb:/mnt/session/uploads fuse.rclone ro,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,max_read=1048576
`-/mnt/session/outputs rclone-filestore:sesn_01GSzPZ4xRq3rg7Dioky6LYb:/mnt/session/outputs fuse.rclone rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,max_read=1048576
The interesting parts are /mnt/skills, /mnt/session/uploads, and /mnt/session/outputs. Files from some cloud storage are being mounted locally in the sandbox environment using rclone. Could the actual storage be an S3 bucket?
This mechanism allows files uploaded during a session to be mounted in the sandbox environment, and conversely, files generated in the sandbox environment can be downloaded via Claude's Files API.
※01GSzPZ4xRq3rg7Dioky6LYb is the session ID used for this investigation.
capsh --print
I also checked the capabilities with capsh --print. The results were as follows.
Current: =ep cap_sys_resource-ep
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore
Ambient set =
Current IAB: !cap_sys_resource
Securebits: 00/0x0/1'b0 (no-new-privs=0)
secure-noroot: no (unlocked)
secure-no-suid-fixup: no (unlocked)
secure-keep-caps: no (unlocked)
secure-no-ambient-raise: no (unlocked)
uid=0(root) euid=0(root)
gid=0(root)
groups=
Guessed mode: HYBRID (4)
Everything except cap_sys_resource is permitted. While it is controlled so that resource limits set in the sandbox environment cannot be changed, a wide range of other operations are permitted.
pstree -p 1
Finally, I ran pstree. The results were as follows.
process_api(1)-+-6(77)
|-rclone-filestor(78)-+-{rclone-filestor}(80)
| |-{rclone-filestor}(81)
| |-{rclone-filestor}(82)
| |-{rclone-filestor}(83)
| |-{rclone-filestor}(84)
| |-{rclone-filestor}(85)
| |-{rclone-filestor}(86)
| |-{rclone-filestor}(87)
| |-{rclone-filestor}(88)
| |-{rclone-filestor}(89)
| |-{rclone-filestor}(90)
| |-{rclone-filestor}(91)
| |-{rclone-filestor}(92)
| |-{rclone-filestor}(93)
| |-{rclone-filestor}(94)
| |-{rclone-filestor}(95)
| |-{rclone-filestor}(96)
| |-{rclone-filestor}(97)
| |-{rclone-filestor}(98)
| |-{rclone-filestor}(99)
| |-{rclone-filestor}(100)
| `-{rclone-filestor}(101)
|-sh(341)---sleep(355)
|-tmux: server(114)---bash(115)---pstree(356)
|-{process_api}(66)
|-{process_api}(67)
|-{process_api}(68)
|-{process_api}(69)
|-{process_api}(70)
|-{process_api}(71)
|-{process_api}(75)
|-{process_api}(76)
`-{process_api}(242)
pid 1 was a process called process_api specified in the kernel arguments. Looking at this output and the earlier capsh --print results, it appears that while the sandbox environment implements VM-level environment isolation via Firecracker MicroVM, it does not seem to be running a container runtime like firecracker-containerd.
Summary
Upon investigating the cloud sandbox execution environment for Claude Managed Agents, I found that it is running on Firecracker!
While this may not be particularly earth-shattering news, I think it's enjoyable to imagine and explore what's happening behind the scenes of such infrastructure.
