Run isolated sandboxes with full lifecycle control: AWS Lambda introduces MicroVMs

AWS has announced the introduction of Lambda MicroVMs, a significant enhancement to its serverless computing offerings. This new primitive allows developers to run user-generated or AI-generated code within highly isolated and stateful execution environments. The core technology behind Lambda MicroVMs is Firecracker, a lightweight virtualization solution already proven at scale with trillions of existing Lambda function invocations. The primary benefit of Lambda MicroVMs is the provision of virtual machine-level isolation. Each MicroVM operates with its own dedicated resources and no shared kernel, ensuring that untrusted code from one user is securely contained within its environment, preventing access to other users' data or the underlying system. This level of isolation is crucial for multi-tenant applications that handle potentially malicious or unpredictable code. Beyond isolation, MicroVMs boast rapid launch and resume capabilities. Developers can create a MicroVM Image by providing a Dockerfile and code package, which Lambda then uses to initialize the application and take a Firecracker snapshot of its running memory and disk state. This "image-then-launch" model allows for near-instantaneous startup and the ability to pause and resume sessions, preserving the application's state for up to eight hours. This feature is particularly valuable for interactive applications where users expect quick responsiveness and persistent sessions, such as AI coding assistants, code environments, and analytics platforms. AWS Lambda MicroVMs are designed to complement existing Lambda Functions. While Lambda Functions remain ideal for event-driven, request-response workloads, MicroVMs are purpose-built for scenarios requiring isolated, stateful execution of untrusted code. This allows applications to leverage Lambda Functions for their event-driven backbones while offloading the execution of user- or AI-generated code to MicroVMs for enhanced security and state management. The service is manageable via the AWS console, CloudFormation, CDK, or the Agent Toolkit for AWS, and is currently available in five AWS regions.