Claude Managed Agentsのクラウドサンドボックス実行環境はFirecracker上で稼働しているという話
Claude Managed AgentsのクラウドサンドボックスはFirecrackerのMicroVM上稼働しているようでした。
2026.09.16
リテールアプリ共創部@大阪の岩田です。
先日Lambda MicroVMs上でClaude Managed Agentsのセルフホスト型サンドボックスの起動に挑戦してみました。
で、このあと気になったのが、Anthropicが管理する通常のクラウドサンドボックスはどんな環境で稼働しているのか？ということです。
公式ドキュメントではクラウドサンドボックスについて以下のように紹介されています。
Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure. They come pre-installed with a comprehensive set of programming languages, databases, and utilities. The agent can use these immediately without any installation steps.
Anthropicが管理するインフラストラクチャ上で、隔離されたLinuxコンテナとして実行されているとのことですが、具体的にどんな技術が使われているのでしょう？可能な範囲で検証してみました。
おことわり
やってみる
それではさっそく確認していきましょう。
以後はClaude ConsoleからBashツールで各種OSコマンドの実行を依頼して、Bashツールが実行されている環境がどういう環境なのか調べていきます。
uname -a
まずはuname -aの実行結果です。
Linux vm 6.18.44-fc-v33 #1 SMP PREEMPT_DYNAMIC @0 x86_64 x86_64 x86_64 GNU/Linux
ん...？fc-v33とは一体？！
※ちなみにブログ執筆の数日前に確認したときはfc-v24でした
cat /proc/cmdline
続いてcat /proc/cmdlineを実行してみました。結果は以下の通りでした。
※読みやすいように改行しています。
deferred_init=lazy dhash_entries=131072 ihash_entries=65536 console=ttyS0 reboot=k panic=1
nomodule random.trust_cpu=1 ipv6.disable=1 swiotlb=noforce psi=1 rdinit=/
process_api -- --firecracker-init --addr 0.0.0.0:2024 --max-ws-buffer-size 32768
--block-local-connections --listen-vsock-port 2024 --log-vsock-port 5002
途中に--firecracker-initというオプションが指定されています。これはFirecrackerのMicroVM上でサンドボックスが稼働しているということではないでしょうか？？
dmesg
今度はdmesgを実行してみましょう。結果は以下の通りで、先程確認したカーネル引数以外にも追加で色々面白そうな情報が確認できました。
dmesgの結果
[ 0.000000] Linux version 6.18.44-fc-v33 (builder@sandboxing) (gcc (GCC) 15.3.0, GNU ld (GNU Binutils) 2.46) #1 SMP PREEMPT_DYNAMIC @0
[ 0.000000] Command line: deferred_init=lazy dhash_entries=131072 ihash_entries=65536 console=ttyS0 reboot=k panic=1 nomodule random.trust_cpu=1 ipv6.disable=1 swiotlb=noforce psi=1 rdinit=/process_api -- --firecracker-init --addr 0.0.0.0:2024 --max-ws-buffer-size 32768 --block-local-connections --listen-vsock-port 2024 --log-vsock-port 5002
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x00000000000fffff] reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bfffffff] usable
[ 0.000000] BIOS-e820: [mem 0x00000000eec00000-0x00000000febfffff] reserved
[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000043fffffff] usable
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] APIC: Static calls initialized
[ 0.000000] DMI not present or invalid.
[ 0.000000] Hypervisor detected: KVM
[ 0.000000] last_pfn = 0xc0000 max_arch_pfn = 0x400000000
[ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00
[ 0.000001] kvm-clock: using sched offset of 77378013 cycles
[ 0.000003] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
[ 0.000105] tsc: Detected 2799.998 MHz processor
[ 0.001202] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved
[ 0.001205] e820: remove [mem 0x000a0000-0x000fffff] usable
[ 0.001209] last_pfn = 0x440000 max_arch_pfn = 0x400000000
[ 0.001688] MTRR map: 0 entries (0 fixed + 0 variable; max 16), built from 8 variable MTRRs
[ 0.001824] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT
[ 0.002465] last_pfn = 0xc0000 max_arch_pfn = 0x400000000
[ 0.002601] Using GB pages for direct mapping
[ 0.002918] RAMDISK: [mem 0xbf4a4000-0xbfffffff]
[ 0.003038] ACPI: Early table checksum verification disabled
[ 0.003334] ACPI: RSDP 0x00000000000E0000 000024 (v02 FIRECK)
[ 0.003454] ACPI: XSDT 0x00000000000A0F35 00003C (v01 FIRECK FCMVXSDT 00000000 FCAT 20240119)
[ 0.003572] ACPI: FACP 0x00000000000A0D8D 000114 (v06 FIRECK FCVMFADT 00000000 FCAT 20240119)
[ 0.003654] ACPI: DSDT 0x000000000009FD6C 001021 (v02 FIRECK FCVMDSDT 00000000 FCAT 20240119)
[ 0.003659] ACPI: APIC 0x00000000000A0EA1 000058 (v06 FIRECK FCVMMADT 00000000 FCAT 20240119)
[ 0.003663] ACPI: MCFG 0x00000000000A0EF9 00003C (v01 FIRECK FCMVMCFG 00000000 FCAT 20240119)
[ 0.003667] ACPI: Reserving FACP table memory at [mem 0xa0d8d-0xa0ea0]
[ 0.003669] ACPI: Reserving DSDT table memory at [mem 0x9fd6c-0xa0d8c]
[ 0.003670] ACPI: Reserving APIC table memory at [mem 0xa0ea1-0xa0ef8]
[ 0.003671] ACPI: Reserving MCFG table memory at [mem 0xa0ef9-0xa0f34]
[ 0.006615] No NUMA configuration found
[ 0.006617] Faking a node at [mem 0x0000000000000000-0x000000043fffffff]
[ 0.006646] NODE_DATA(0) allocated [mem 0x43ffde3c0-0x43fffffff]
[ 0.008129] Zone ranges:
[ 0.008179] DMA [mem 0x0000000000001000-0x0000000000ffffff]
[ 0.008206] DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
[ 0.008232] Normal [mem 0x0000000100000000-0x000000043fffffff]
[ 0.008258] Movable zone start for each node
[ 0.008284] Early memory node ranges
[ 0.008285] node 0: [mem 0x0000000000001000-0x000000000009efff]
[ 0.008286] node 0: [mem 0x0000000000100000-0x00000000bfffffff]
[ 0.008288] node 0: [mem 0x0000000100000000-0x000000043fffffff]
[ 0.008290] Initmem setup node 0 [mem 0x0000000000001000-0x000000043fffffff]
[ 0.008479] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.009798] On node 0, zone DMA: 97 pages in unavailable ranges
[ 0.286676] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
[ 0.286705] ACPI: Using ACPI (MADT) for SMP configuration information
[ 0.286729] TSC deadline timer available
[ 0.286733] CPU topo: Max. logical packages: 1
[ 0.286754] CPU topo: Max. logical dies: 1
[ 0.286754] CPU topo: Max. dies per package: 1
[ 0.286757] CPU topo: Max. threads per core: 1
[ 0.286758] CPU topo: Num. cores per package: 4
[ 0.286759] CPU topo: Num. threads per package: 4
[ 0.286759] CPU topo: Allowing 4 present CPUs plus 0 hotplug CPUs
[ 0.286893] kvm-guest: APIC: eoi() replaced with kvm_guest_apic_eoi_write()
[ 0.287183] kvm-guest: KVM setup pv remote TLB flush
[ 0.287222] kvm-guest: setup PV sched yield
[ 0.287371] [mem 0xc0000000-0xeebfffff] available for PCI devices
[ 0.287373] Booting paravirtualized kernel on KVM
[ 0.287375] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
[ 0.287474] Kernel is locked down from Kernel configuration; see man kernel_lockdown.7
[ 0.287612] setup_percpu: NR_CPUS:256 nr_cpumask_bits:4 nr_cpu_ids:4 nr_node_ids:1
[ 0.298992] percpu: Embedded 52 pages/cpu s183320 r0 d29672 u524288
[ 0.299043] pcpu-alloc: s183320 r0 d29672 u524288 alloc=1*2097152
[ 0.299046] pcpu-alloc: [0] 0 1 2 3
[ 0.299222] kvm-guest: PV spinlocks enabled
[ 0.299245] PV qspinlock hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.299268] Kernel command line: deferred_init=lazy dhash_entries=131072 ihash_entries=65536 console=ttyS0 reboot=k panic=1 nomodule random.trust_cpu=1 ipv6.disable=1 swiotlb=noforce psi=1 rdinit=/process_api -- --firecracker-init --addr 0.0.0.0:2024 --max-ws-buffer-size 32768 --block-local-connections --listen-vsock-port 2024 --log-vsock-port 5002
[ 0.300663] random: crng init done
[ 0.300665] printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
[ 0.305975] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.309537] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.309839] Fallback order for Node 0: 0
[ 0.309906] Built 1 zonelists, mobility grouping on. Total pages: 4194206
[ 0.309908] Policy zone: Normal
[ 0.309910] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.341002] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.394557] ftrace: allocating 44286 entries in 176 pages
[ 0.394580] ftrace: allocated 176 pages with 3 groups
[ 0.396767] Dynamic Preempt: none
[ 0.397261] rcu: Preemptible hierarchical RCU implementation.
[ 0.397310] rcu: RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=4.
[ 0.397312] Trampoline variant of Tasks RCU enabled.
[ 0.397334] Rude variant of Tasks RCU enabled.
[ 0.397335] Tracing variant of Tasks RCU enabled.
[ 0.397336] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.397337] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[ 0.397404] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.397406] RCU Tasks Rude: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.397408] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.409526] NR_IRQS: 16640, nr_irqs: 440, preallocated irqs: 0
[ 0.409666] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.409686] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.409882] Console: colour dummy device 80x25
[ 0.410123] printk: legacy console [ttyS0] enabled
[ 0.766773] ACPI: Core revision 20250807
[ 0.769048] APIC: Switch to symmetric I/O mode setup
[ 0.773210] x2apic enabled
[ 0.776191] APIC: Switched APIC routing to: physical x2apic
[ 0.779204] kvm-guest: APIC: send_IPI_mask() replaced with kvm_send_ipi_mask()
[ 0.783122] kvm-guest: APIC: send_IPI_mask_allbutself() replaced with kvm_send_ipi_mask_allbutself()
[ 0.788055] kvm-guest: setup PV IPIs
[ 0.790556] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x285c3ee517e, max_idle_ns: 440795257231 ns
[ 0.796170] Calibrating delay loop (skipped) preset value.. 5599.99 BogoMIPS (lpj=11199992)
[ 0.800165] x86/cpu: User Mode Instruction Prevention (UMIP) activated
[ 0.800165] Last level iTLB entries: 4KB 64, 2MB 8, 4MB 8
[ 0.800165] Last level dTLB entries: 4KB 64, 2MB 32, 4MB 32, 1GB 4
[ 0.800165] mitigations: Enabled attack vectors: user_kernel, user_user, SMT mitigations: auto
[ 0.800165] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[ 0.800165] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.800165] RETBleed: Mitigation: Enhanced IBRS
[ 0.800165] ITS: Mitigation: Aligned branch/return thunks
[ 0.800165] TAA: Vulnerable: Clear CPU buffers attempted, no microcode
[ 0.800165] MMIO Stale Data: Vulnerable: Clear CPU buffers attempted, no microcode
[ 0.800165] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 0.800165] Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT
[ 0.800165] Spectre V2 : Enabling IBPB for BPF
[ 0.800165] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 0.800165] active return thunk: its_return_thunk
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
[ 0.800165] x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
[ 0.800165] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
[ 0.800165] x86/fpu: xstate_offset[5]: 832, xstate_sizes[5]: 64
[ 0.800165] x86/fpu: xstate_offset[6]: 896, xstate_sizes[6]: 512
[ 0.800165] x86/fpu: xstate_offset[7]: 1408, xstate_sizes[7]: 1024
[ 0.800165] x86/fpu: Enabled xstate features 0xe7, context size is 2432 bytes, using 'compacted' format.
[ 0.800165] Freeing SMP alternatives memory: 44K
[ 0.800165] pid_max: default: 32768 minimum: 301
[ 0.800165] LSM: initializing lsm=lockdown,capability,landlock,selinux
[ 0.800165] landlock: Up and running.
[ 0.800165] SELinux: Initializing.
[ 0.800165] Mount-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.800165] Mountpoint-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.800165] smpboot: CPU0: Intel(R) Xeon(R) Processor @ 2.80GHz (family: 0x6, model: 0x55, stepping: 0x7)
[ 0.801589] Performance Events: unsupported CPU family 6 model 85 no PMU driver, software events only.
[ 0.804413] signal: max sigframe size: 3632
[ 0.806653] pvm-pv: not detected, 0/45 sites patched
[ 0.808293] rcu: Hierarchical SRCU implementation.
[ 0.810728] rcu: Max phase no-delay instances is 1000.
[ 0.812803] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 0.816799] NMI watchdog: Perf NMI watchdog permanently disabled
[ 0.820377] smp: Bringing up secondary CPUs ...
[ 0.823585] smpboot: x86: Booting SMP configuration:
[ 0.824180] .... node #0, CPUs: #1 #2 #3
[ 0.832289] smp: Brought up 1 node, 4 CPUs
[ 0.838478] smpboot: Total of 4 processors activated (22399.98 BogoMIPS)
[ 0.841992] deferred_init=lazy: 3308913 pages left to deferred_grow_zone()
[ 0.844183] Memory: 3224216K/16776824K available (15877K kernel code, 2035K rwdata, 8712K rodata, 3540K init, 2456K bss, 311808K reserved, 0K cma-reserved)
[ 0.848974] devtmpfs: initialized
[ 0.850074] x86/mm: Memory block size: 128MB
[ 0.856303] posixtimers hash table entries: 2048 (order: 3, 32768 bytes, linear)
[ 0.860643] futex hash table entries: 1024 (65536 bytes on 1 NUMA nodes, total 64 KiB, linear).
[ 0.875081] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.876259] audit: initializing netlink subsys (disabled)
[ 0.879029] audit: type=2000 audit(1789434532.867:1): state=initialized audit_enabled=0 res=1
[ 0.879029] thermal_sys: Registered thermal governor 'fair_share'
[ 0.880179] thermal_sys: Registered thermal governor 'step_wise'
[ 0.883254] thermal_sys: Registered thermal governor 'user_space'
[ 0.884205] cpuidle: using governor ladder
[ 0.888197] cpuidle: using governor menu
[ 0.890888] PCI: ECAM [mem 0xeec00000-0xeecfffff] (base 0xeec00000) for domain 0000 [bus 00-00]
[ 0.892182] PCI: ECAM [mem 0xeec00000-0xeecfffff] reserved as E820 entry
[ 0.895655] PCI: Using configuration type 1 for base access
[ 0.897138] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[ 0.900181] HugeTLB: 16380 KiB vmemmap can be freed for a 1.00 GiB page
[ 0.903515] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.904177] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.910608] ACPI: Added _OSI(Module Device)
[ 0.912179] ACPI: Added _OSI(Processor Device)
[ 0.914447] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.916620] ACPI: 1 ACPI AML tables successfully acquired and loaded
[ 0.920238] ACPI: Interpreter enabled
[ 0.922144] ACPI: PM: (supports S0)
[ 0.924178] ACPI: Using IOAPIC for interrupt routing
[ 0.926746] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 0.928177] PCI: Using E820 reservations for host bridge windows
[ 0.933487] ACPI: PCI Root Bridge [PC00] (domain 0000 [bus 00])
[ 0.936184] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3]
[ 0.940178] acpi PNP0A08:00: PCIe port services disabled; not requesting _OSC control
[ 0.944134] acpi PNP0A08:00: _OSC: platform retains control of PCIe features (AE_NOT_FOUND)
[ 0.944329] PCI host bridge to bus 0000:00
[ 0.946447] pci_bus 0000:00: root bus resource [mem 0xeec00000-0xeecfffff]
[ 0.948180] pci_bus 0000:00: root bus resource [mem 0xc0001000-0xeebfffff window]
[ 0.952034] pci_bus 0000:00: root bus resource [mem 0x4000000000-0x7fffffffff window]
[ 0.952181] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 0.955598] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 0.956181] pci_bus 0000:00: root bus resource [bus 00]
[ 0.959216] pci 0000:00:00.0: [8086:0d57] type 00 class 0x060000 conventional PCI endpoint
[ 0.963469] pci 0000:00:01.0: [1af4:1045] type 00 class 0xffff00 conventional PCI endpoint
[ 0.965686] pci 0000:00:01.0: BAR 0 [mem 0x4000000000-0x400007ffff 64bit]
[ 0.972123] pci 0000:00:02.0: [1af4:1042] type 00 class 0x018000 conventional PCI endpoint
[ 0.973662] pci 0000:00:02.0: BAR 0 [mem 0x4000080000-0x40000fffff 64bit]
[ 0.980150] pci 0000:00:03.0: [1af4:1042] type 00 class 0x018000 conventional PCI endpoint
[ 0.981654] pci 0000:00:03.0: BAR 0 [mem 0x4000100000-0x400017ffff 64bit]
[ 0.988157] pci 0000:00:04.0: [1af4:1041] type 00 class 0x020000 conventional PCI endpoint
[ 0.989649] pci 0000:00:04.0: BAR 0 [mem 0x4000180000-0x40001fffff 64bit]
[ 0.996110] pci 0000:00:05.0: [1af4:1053] type 00 class 0xffff00 conventional PCI endpoint
[ 0.997668] pci 0000:00:05.0: BAR 0 [mem 0x4000200000-0x400027ffff 64bit]
[ 1.004126] pci 0000:00:06.0: [1af4:1044] type 00 class 0xffff00 conventional PCI endpoint
[ 1.005663] pci 0000:00:06.0: BAR 0 [mem 0x4000280000-0x40002fffff 64bit]
[ 1.019151] iommu: Default domain type: Translated
[ 1.020178] iommu: DMA domain TLB invalidation policy: lazy mode
[ 1.023263] pps_core: LinuxPPS API ver. 1 registered
[ 1.024178] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 1.028252] PTP clock support registered
[ 1.031220] NetLabel: Initializing
[ 1.032180] NetLabel: domain hash size = 128
[ 1.034454] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 1.036214] NetLabel: unlabeled traffic allowed by default
[ 1.039017] PCI: Using ACPI for IRQ routing
[ 1.040178] PCI: pci_cache_line_size set to 64 bytes
[ 1.040785] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff]
[ 1.040831] vgaarb: loaded
[ 1.041626] clocksource: Switched to clocksource kvm-clock
[ 1.045060] VFS: Disk quotas dquot_6.6.0
[ 1.047233] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 1.051437] pnp: PnP ACPI init
[ 1.053410] pnp: PnP ACPI: found 5 devices
[ 1.061186] NET: Registered PF_INET protocol family
[ 1.073728] IP idents hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 1.123113] tcp_listen_portaddr_hash hash table entries: 8192 (order: 5, 131072 bytes, linear)
[ 1.127612] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 1.131556] TCP established hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 1.140489] TCP bind hash table entries: 65536 (order: 9, 2097152 bytes, linear)
[ 1.155012] TCP: Hash tables configured (established 131072 bind 65536)
[ 1.159015] MPTCP token hash table entries: 16384 (order: 7, 393216 bytes, linear)
[ 1.163010] UDP hash table entries: 8192 (order: 7, 524288 bytes, linear)
[ 1.169359] UDP-Lite hash table entries: 8192 (order: 7, 524288 bytes, linear)
[ 1.175619] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 1.178643] NET: Registered PF_XDP protocol family
[ 1.181135] pci_bus 0000:00: resource 4 [mem 0xeec00000-0xeecfffff]
[ 1.184336] pci_bus 0000:00: resource 5 [mem 0xc0001000-0xeebfffff window]
[ 1.187829] pci_bus 0000:00: resource 6 [mem 0x4000000000-0x7fffffffff window]
[ 1.191646] pci_bus 0000:00: resource 7 [io 0x0000-0x0cf7 window]
[ 1.194889] pci_bus 0000:00: resource 8 [io 0x0d00-0xffff window]
[ 1.198384] PCI: CLS 0 bytes, default 64
[ 1.200498] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 1.201012] Unpacking initramfs...
[ 1.203874] software IO TLB: No low mem
[ 1.207964] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 1.212474] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x285c3ee517e, max_idle_ns: 440795257231 ns
[ 1.217849] clocksource: Switched to clocksource tsc
[ 1.220727] platform rtc_cmos: registered platform RTC device (no PNP device found)
[ 1.231648] Initialise system trusted keyrings
[ 1.233959] Key type blacklist registered
[ 1.236338] workingset: timestamp_bits=36 max_order=22 bucket_order=0
[ 1.240120] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.246558] fuse: init (API version 7.45)
[ 1.258726] Key type asymmetric registered
[ 1.260821] Asymmetric key parser 'x509' registered
[ 1.263615] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 1.267769] io scheduler mq-deadline registered
[ 1.270160] io scheduler kyber registered
[ 1.273386] io scheduler bfq registered
[ 1.277076] virtio-pci 0000:00:01.0: enabling device (0000 -> 0002)
[ 1.283191] virtio-pci 0000:00:02.0: enabling device (0000 -> 0002)
[ 1.289264] virtio-pci 0000:00:03.0: enabling device (0000 -> 0002)
[ 1.295321] virtio-pci 0000:00:04.0: enabling device (0000 -> 0002)
[ 1.301369] virtio-pci 0000:00:05.0: enabling device (0000 -> 0002)
[ 1.307599] virtio-pci 0000:00:06.0: enabling device (0000 -> 0002)
[ 1.319407] Free page reporting enabled
[ 1.321881] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 1.325665] 00:00: ttyS0 at I/O 0x3f8 (irq = 26, base_baud = 115200) is a 16550A
[ 1.325895] Freeing initrd memory: 11632K
[ 1.343794] loop: module loaded
[ 1.345992] virtio_blk virtio1: 1/0/0 default/read/poll queues
[ 1.351771] virtio_blk virtio1: [vda] 536870912 512-byte logical blocks (275 GB/256 GiB)
[ 1.358516] virtio_blk virtio2: 1/0/0 default/read/poll queues
[ 1.364203] virtio_blk virtio2: [vdb] 536870912 512-byte logical blocks (275 GB/256 GiB)
[ 1.370008] zram: Added device: zram0
[ 1.372688] tun: Universal TUN/TAP device driver, 1.6
[ 1.379682] intel_pstate: CPU model not supported
[ 1.382132] hid: raw HID events driver (C) Jiri Kosina
[ 1.385000] Mirror/redirect action on
[ 1.386990] u32 classifier
[ 1.388422] input device check on
[ 1.390306] Actions configured
[ 1.412500] xt_time: kernel timezone is -0000
[ 1.414934] Initializing XFRM netlink socket
[ 1.417128] IPv6: Loaded, but administratively disabled, reboot required to enable
[ 1.421159] NET: Registered PF_PACKET protocol family
[ 1.423752] Bridge firewalling registered
[ 1.426339] Key type dns_resolver registered
[ 1.428691] NET: Registered PF_VSOCK protocol family
[ 1.441270] IPI shorthand broadcast: enabled
[ 1.445796] sched_clock: Marking stable (1057035267, 386480423)->(1691338562, -247822872)
[ 1.450567] registered taskstats version 1
[ 1.459051] Loading compiled-in X.509 certificates
[ 1.468243] Demotion targets for Node 0: null
[ 1.470657] Key type .fscrypt registered
[ 1.472645] Key type fscrypt-provisioning registered
[ 1.475952] Key type encrypted registered
[ 1.481292] clk: Disabling unused clocks
[ 1.501850] Freeing unused kernel image (initmem) memory: 3540K
[ 1.503676] Write protecting the kernel read-only data: 26624k
[ 1.507839] Freeing unused kernel image (text/rodata gap) memory: 504K
[ 1.517359] Freeing unused kernel image (rodata/data gap) memory: 1528K
[ 1.519341] Run /process_api as init process
[ 1.520619] with arguments:
[ 1.520620] /process_api
[ 1.520621] --firecracker-init
[ 1.520621] --addr
[ 1.520622] 0.0.0.0:2024
[ 1.520623] --max-ws-buffer-size
[ 1.520623] 32768
[ 1.520624] --block-local-connections
[ 1.520625] --listen-vsock-port
[ 1.520625] 2024
[ 1.520626] --log-vsock-port
[ 1.520626] 5002
[ 1.520627] with environment:
[ 1.520627] HOME=/
[ 1.520628] TERM=linux
[ 2.851189] virtio_blk virtio2: [vdb] new size: 19600 512-byte logical blocks (10.0 MB/9.57 MiB)
[ 2.851202] random: crng reseeded due to virtual machine fork
[ 2.851523] virtio_blk virtio1: [vda] new size: 536870912 512-byte logical blocks (275 GB/256 GiB)
[ 2.853658] vdb: detected capacity change from 536870912 to 19600
[ 2.870751] tokio-rt-worker (71): drop_caches: 3
[ 2.874130] EXT4-fs (vda): warning: mounting unchecked fs, running e2fsck is recommended
[ 2.878348] EXT4-fs (vda): mounted filesystem 2c47d290-c9ae-4956-8d3e-4780b8c56ff8 r/w without journal. Quota mode: none.
まずHypervisor detected: KVMの出力から、サンドボックス環境はKVMの仮想マシン上で起動していると判断できます。
次に、以下の出力からデバイスの仮想化にFirecrackerを利用していることが伺えます。
[ 0.003334] ACPI: RSDP 0x00000000000E0000 000024 (v02 FIRECK)
[ 0.003454] ACPI: XSDT 0x00000000000A0F35 00003C (v01 FIRECK FCMVXSDT 00000000 FCAT 20240119)
[ 0.003572] ACPI: FACP 0x00000000000A0D8D 000114 (v06 FIRECK FCVMFADT 00000000 FCAT 20240119)
[ 0.003654] ACPI: DSDT 0x000000000009FD6C 001021 (v02 FIRECK FCVMDSDT 00000000 FCAT 20240119)
[ 0.003659] ACPI: APIC 0x00000000000A0EA1 000058 (v06 FIRECK FCVMMADT 00000000 FCAT 20240119)
[ 0.003663] ACPI: MCFG 0x00000000000A0EF9 00003C (v01 FIRECK FCMVMCFG 00000000 FCAT 20240119)
FIRECKという文字列はここで定義されていますね。
他にもFCMVXSDTはここ
FCVMFADTはここで定義されています。
他に面白そうなところとして以下の出力も発見しました。
random: crng reseeded due to virtual machine fork
Firecrackerのスナップショットから復元してそうな雰囲気がプンプンです。ちなみにこのメッセージはLinuxカーネルのここで定義されていました。
findmnt
次にfindmntを実行してみました。結果は以下の通りでした。
TARGET SOURCE FSTYPE OPTIONS
/ /dev/vda ext4 rw,relatime,resv_strict,resuid=65534,resgid=65534
|-/proc proc proc rw,relatime
|-/sys sysfs sysfs rw,relatime
| `-/sys/fs/cgroup tmpfs tmpfs rw,relatime,mode=755
| |-/sys/fs/cgroup/cpu cgroup cgroup rw,relatime,cpu
| |-/sys/fs/cgroup/cpuacct cgroup cgroup rw,relatime,cpuacct
| |-/sys/fs/cgroup/cpuset cgroup cgroup rw,relatime,cpuset
| |-/sys/fs/cgroup/memory cgroup cgroup rw,relatime,memory
| |-/sys/fs/cgroup/devices cgroup cgroup rw,relatime,devices
| |-/sys/fs/cgroup/freezer cgroup cgroup rw,relatime,freezer
| |-/sys/fs/cgroup/blkio cgroup cgroup rw,relatime,blkio
| |-/sys/fs/cgroup/pids cgroup cgroup rw,relatime,pids
| |-/sys/fs/cgroup/systemd cgroup cgroup rw,relatime,name=systemd
| `-/sys/fs/cgroup/unified cgroup2 cgroup2 rw,relatime
|-/dev devtmpfs devtmpfs rw,relatime,size=8232508k,nr_inodes=2058127,mode=755
| |-/dev/shm tmpfs tmpfs rw,relatime,size=16482220k
| | `-/dev/shm tmpfs tmpfs rw,relatime,size=16482220k
| `-/dev/pts devpts devpts rw,relatime,mode=600,ptmxmode=000
| `-/dev/pts devpts devpts rw,relatime,mode=600,ptmxmode=000
|-/opt/rclone /dev/vdb squashfs ro,relatime,errors=continue
|-/mnt/sandboxing/model_tools_env/v1/python model_tools_unavailable tmpfs ro,nosuid,nodev,relatime,size=4k,mode=755
|-/run/sandbox-telemetry tmpfs tmpfs rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755,uid=64321,gid=64321
|-/mnt/skills rclone-filestore:sesn_01GSzPZ4xRq3rg7Dioky6LYb:/mnt/skills fuse.rclone ro,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,max_read=1048576
|-/mnt/session/uploads rclone-filestore:sesn_01GSzPZ4xRq3rg7Dioky6LYb:/mnt/session/uploads fuse.rclone ro,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,max_read=1048576
`-/mnt/session/outputs rclone-filestore:sesn_01GSzPZ4xRq3rg7Dioky6LYb:/mnt/session/outputs fuse.rclone rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,max_read=1048576
面白いのは/mnt/skills、/mnt/session/uploads、/mnt/session/outputs あたりですね。rcloneを使ってどこかのクラウドストレージ上のファイルをサンドボックス環境のローカルにマウントしています。実態はS3バケットだったりするんですかね？
この仕組みによってセッション内でアップロードしたファイルがサンドボックス環境にマウントされ、逆にサンドボックス環境で生成したファイルがClaudeのFiles APIでダウンロードできるようになります。
※01GSzPZ4xRq3rg7Dioky6LYbは検証で使用したセッションのIDです。
capsh --print
capsh --printでケーパビリティも確認してみました。結果は以下の通りでした。
Current: =ep cap_sys_resource-ep
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore
Ambient set =
Current IAB: !cap_sys_resource
Securebits: 00/0x0/1'b0 (no-new-privs=0)
secure-noroot: no (unlocked)
secure-no-suid-fixup: no (unlocked)
secure-keep-caps: no (unlocked)
secure-no-ambient-raise: no (unlocked)
uid=0(root) euid=0(root)
gid=0(root)
groups=
Guessed mode: HYBRID (4)
cap_sys_resource以外が許可されています。サンドボックス環境に設定されたリソースの制限を変更できないように制御されていますが、その他は広範囲な操作が許可されていると言えます。
pstree -p 1
最後にpstreeを実行してみました。結果は以下のとおりでした。
process_api(1)-+-6(77)
|-rclone-filestor(78)-+-{rclone-filestor}(80)
| |-{rclone-filestor}(81)
| |-{rclone-filestor}(82)
| |-{rclone-filestor}(83)
| |-{rclone-filestor}(84)
| |-{rclone-filestor}(85)
| |-{rclone-filestor}(86)
| |-{rclone-filestor}(87)
| |-{rclone-filestor}(88)
| |-{rclone-filestor}(89)
| |-{rclone-filestor}(90)
| |-{rclone-filestor}(91)
| |-{rclone-filestor}(92)
| |-{rclone-filestor}(93)
| |-{rclone-filestor}(94)
| |-{rclone-filestor}(95)
| |-{rclone-filestor}(96)
| |-{rclone-filestor}(97)
| |-{rclone-filestor}(98)
| |-{rclone-filestor}(99)
| |-{rclone-filestor}(100)
| `-{rclone-filestor}(101)
|-sh(341)---sleep(355)
|-tmux: server(114)---bash(115)---pstree(356)
|-{process_api}(66)
|-{process_api}(67)
|-{process_api}(68)
|-{process_api}(69)
|-{process_api}(70)
|-{process_api}(71)
|-{process_api}(75)
|-{process_api}(76)
`-{process_api}(242)
pid 1はカーネル引数で指定されたprocess_apiというプロセスでした。この出力や先ほどのcapsh --printの結果を見るにサンドボックス環境はFirecrackerのMicroVMによるVMレベルの環境分離は実装されているものの、Firecracker-containerdのようなコンテナランタイムを実行しているわけでは無さそうですね。
まとめ
Claude Managed Agentsのクラウドサンドボックス実行環境について確認してみたところ、Firecracker上で稼働しているということが分かりました！
だから何だという話ではあるのですが、こういう基盤の裏側について色々と想像してみるのは楽しいものだと思います。
