aws-lambda-microvms

Name: aws-lambda-microvms
Author: awslabs

843stars132forks

How to install aws-lambda-microvms?

awslabs/agent-plugins/aws-lambda-microvms

$npx -y skills add awslabs/agent-plugins --skill aws-lambda-microvms

Installs into the current project.

Summary

Build, run, debug, and operate applications on AWS Lambda MicroVMs — Firecracker-isolated, snapshot-resumable serverless compute environments that run inside a container with up to 8-hour lifetimes. Triggers on: Lambda MicroVMs, Firecracker isolation, snapshot-resumable compute,

Files · 1

View on GitHub

SKILL.md

1	# AWS Lambda MicroVMs
2
3	> The AWS MCP server is recommended for sandboxed execution and audit logging.
4
5	AWS Lambda MicroVMs are serverless compute environments that combine Firecracker VM isolation with container-like efficiency. Each MicroVM:
6
7	- Runs your application as a container inside a Firecracker microVM — you can reproduce the environment locally.
8	- Runs Amazon Linux 2023 as the base OS inside the MicroVM.
9	- Boots from a memory + disk snapshot captured at image build time, so application init is skipped on run.
10	- Has a dedicated, TLS-terminated HTTPS endpoint reachable with an auth token.
11	- Can be suspended and resumed with state preserved; lives up to 8 hours.
12
13	Two-resource model:
14
15	- `MicrovmImage` — a versioned artifact built from `{S3 zip with Dockerfile} + baseImageArn`. Each version has per-architecture/chipset `Build`s.
16	- `Microvm` — a running instance created (`RunMicrovm`) from an image version.
17
18	Two roles:
19
20	- `buildRoleArn` — used during image build (S3 read, CloudWatch logs, optional ECR).
21	- `executionRoleArn` — assumed at runtime by the running MicroVM.
22
23	## When to use
24
25	### Choose Lambda MicroVMs when
26
27	- Analytics workloads — isolated compute for data processing, ETL jobs, or query execution with strong tenant separation.
28	- AI / agent code execution sandboxes — fresh, isolated environment per session, fast resume between turns.
29	- Interactive code playgrounds & notebooks — Jupyter, REPLs, dev environments executing user code.
30	- Reinforcement-learning environments — clean per-episode envs with tool access.
31	- Multi-tenant CI executors / build runners — strong tenant isolation.
32	- Game / simulation servers — sessionful, long-lived (up to 8 hr) workloads.
33	- Security scanning — running untrusted analyzers in isolation.
34
35	In general, Lambda MicroVMs are suited for long-lived sessions, real port-listening servers (gRPC, WebSocket, custom TCP protocols), state preserved across periods of inactivity (suspend/resume), container-level access (FUSE, eBPF, custom syscalls), or session-affine routing to a specific compute environment.
36
37	### Choose AWS Lambda (functions) when
38
39	- The workload fits in 15 minutes.
40	- Per-invocation isolation is fine; no need for session state held in memory.
41	- Fully automatic scaling is preferred (no `RunMicrovm` to manage).
42	- Event-source integrations (S3, SQS, EventBridge, etc.) drive the function.
43
44	### Choose something else when
45
46	- Continuous compute beyond 8 hr → ECS / EKS / EC2.
47	- Lift-and-shift workloads needing kernel modifications or a non-Linux OS → EC2.
48
49	## Typical workflow
50
51	0. Check regional availability — confirm Lambda MicroVMs is available in your target region (run `aws lambda-microvms list-managed-microvm-images`). Your S3 artifact bucket and any network connectors must be in the same region as the image.
52	1. Package an app: zip with a `Dockerfile` at the root, upload to S3 (same region as the image).
53	2. Implement lifecycle hooks (optional but recommended) — HTTP endpoints on a port you specify (commonly `9000`) for `/run`, `/resume`, `/suspend`, `/terminate`, `/ready`, `/validate`.
54	3. CreateMicrovmImage — pointing at the S3 artifact, a managed base image, and a build role. Lambda compiles the Dockerfile into an OCI image, starts your app, calls `/ready`, snapshots disk + memory, optionally validates with `/validate`. Lambda will periodically release new managed image versions, and customers should re-build using the latest version to ensure they have up to date images.
55	4. RunMicrovm — pick an image version, attach `executionRoleArn`, set `idlePolicy`, ingress/egress connectors, and (optionally) a `runHookPayload`. Receive an `endpoint` URL and `microvmId`.
56	5. CreateMicrovmAuthToken — get an auth token (max 60 min) with `allowedPorts` specifying which ports the token grants access to. Send traffic to the endpoint with `X-aws-proxy-auth: <token>`.
57	6. Suspend / Resume / Terminate — explicit APIs, or let the `idlePoli

People who liked this also viewed

6 picks

Type

aws-lambda-microvms

843stars132forks

View on GitHub

How to install aws-lambda-microvms?

awslabs/agent-plugins/aws-lambda-microvms

$npx -y skills add awslabs/agent-plugins --skill aws-lambda-microvms

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Lambda MicroVMs
2
3	> The AWS MCP server is recommended for sandboxed execution and audit logging.
4
5	AWS Lambda MicroVMs are serverless compute environments that combine Firecracker VM isolation with container-like efficiency. Each MicroVM:
6
7	- Runs your application as a container inside a Firecracker microVM — you can reproduce the environment locally.
8	- Runs Amazon Linux 2023 as the base OS inside the MicroVM.
9	- Boots from a memory + disk snapshot captured at image build time, so application init is skipped on run.
10	- Has a dedicated, TLS-terminated HTTPS endpoint reachable with an auth token.
11	- Can be suspended and resumed with state preserved; lives up to 8 hours.
12
13	Two-resource model:
14
15	- `MicrovmImage` — a versioned artifact built from `{S3 zip with Dockerfile} + baseImageArn`. Each version has per-architecture/chipset `Build`s.
16	- `Microvm` — a running instance created (`RunMicrovm`) from an image version.
17
18	Two roles:
19
20	- `buildRoleArn` — used during image build (S3 read, CloudWatch logs, optional ECR).
21	- `executionRoleArn` — assumed at runtime by the running MicroVM.
22
23	## When to use
24
25	### Choose Lambda MicroVMs when
26
27	- Analytics workloads — isolated compute for data processing, ETL jobs, or query execution with strong tenant separation.
28	- AI / agent code execution sandboxes — fresh, isolated environment per session, fast resume between turns.
29	- Interactive code playgrounds & notebooks — Jupyter, REPLs, dev environments executing user code.
30	- Reinforcement-learning environments — clean per-episode envs with tool access.
31	- Multi-tenant CI executors / build runners — strong tenant isolation.
32	- Game / simulation servers — sessionful, long-lived (up to 8 hr) workloads.
33	- Security scanning — running untrusted analyzers in isolation.
34
35	In general, Lambda MicroVMs are suited for long-lived sessions, real port-listening servers (gRPC, WebSocket, custom TCP protocols), state preserved across periods of inactivity (suspend/resume), container-level access (FUSE, eBPF, custom syscalls), or session-affine routing to a specific compute environment.
36
37	### Choose AWS Lambda (functions) when
38
39	- The workload fits in 15 minutes.
40	- Per-invocation isolation is fine; no need for session state held in memory.
41	- Fully automatic scaling is preferred (no `RunMicrovm` to manage).
42	- Event-source integrations (S3, SQS, EventBridge, etc.) drive the function.
43
44	### Choose something else when
45
46	- Continuous compute beyond 8 hr → ECS / EKS / EC2.
47	- Lift-and-shift workloads needing kernel modifications or a non-Linux OS → EC2.
48
49	## Typical workflow
50
51	0. Check regional availability — confirm Lambda MicroVMs is available in your target region (run `aws lambda-microvms list-managed-microvm-images`). Your S3 artifact bucket and any network connectors must be in the same region as the image.
52	1. Package an app: zip with a `Dockerfile` at the root, upload to S3 (same region as the image).
53	2. Implement lifecycle hooks (optional but recommended) — HTTP endpoints on a port you specify (commonly `9000`) for `/run`, `/resume`, `/suspend`, `/terminate`, `/ready`, `/validate`.
54	3. CreateMicrovmImage — pointing at the S3 artifact, a managed base image, and a build role. Lambda compiles the Dockerfile into an OCI image, starts your app, calls `/ready`, snapshots disk + memory, optionally validates with `/validate`. Lambda will periodically release new managed image versions, and customers should re-build using the latest version to ensure they have up to date images.
55	4. RunMicrovm — pick an image version, attach `executionRoleArn`, set `idlePolicy`, ingress/egress connectors, and (optionally) a `runHookPayload`. Receive an `endpoint` URL and `microvmId`.
56	5. CreateMicrovmAuthToken — get an auth token (max 60 min) with `allowedPorts` specifying which ports the token grants access to. Send traffic to the endpoint with `X-aws-proxy-auth: <token>`.
57	6. Suspend / Resume / Terminate — explicit APIs, or let the `idlePoli

People who liked this also viewed

6 picks

Type