By Every platform that lets users execute code faces the same uncomfortable truth: containers share a kernel. That shared kernel is a trust boundary you cannot fully enforce. For years, the workaround was to roll your own Firecracker setup — manage VM lifecycle, wire up snapshots, handle suspend and resume yourself. Most teams skipped it and accepted the risk. In June 2026, AWS removed that excuse.
Lambda MicroVMs gives every user session its own dedicated Firecracker virtual machine, managed like a serverless function. It is not a new feature added to Lambda. It is a separate compute primitive — positioned between stateless Lambda functions and full EC2 instances — built specifically for the workload that had no clean answer: running code you did not write, for users you cannot fully trust.
Why Containers Were Never Enough
Containers are fast, efficient, and widely understood. They are also insufficient when the code inside them is untrusted. A container shares the host kernel. A sufficiently motivated attacker with user-supplied code has a path to the host that does not exist in a VM. For internal workloads where you wrote every line, the tradeoff is fine. For AI coding assistants, interactive notebooks, or platforms executing AI-generated code, it is not.
The alternative — self-managed Firecracker — required building the exact infrastructure AWS already runs internally. Lambda has been powered by Firecracker since 2018, handling over 15 trillion invocations per month. Lambda MicroVMs exposes that technology as a managed API.
The Snapshot Trick
The obvious objection to VMs is cold starts. Containers boot in milliseconds; VMs take seconds. Lambda MicroVMs sidesteps this entirely through snapshot-based initialization.
The workflow: you provide a Dockerfile and a code package. AWS runs your Dockerfile, initializes the application, then snapshots the entire MicroVM — memory and disk — at that point. Every subsequent launch resumes from the snapshot rather than cold-booting. Measured numbers from testing show the first launch reaching RUNNING state in roughly 12 seconds; suspend-to-resume cycles run at 1.86 seconds.
One gotcha worth flagging immediately: anything generated during your Dockerfile build is shared across every VM launched from that image. Unique IDs, secrets, and random seeds must be generated after each MicroVM starts, in the run lifecycle hook, not baked into the image. Shared snapshots are a security property to design around, not a defect.
When to Use Which
Lambda MicroVMs is not a replacement for Lambda Functions. The correct mental model is a decision tree based on two questions: Is the code trusted? Does the session need to preserve state?
| Criterion | Lambda Functions | Lambda MicroVMs | Fargate |
|---|---|---|---|
| Untrusted code safe | No | Yes | No |
| Stateful sessions | No (ephemeral) | Up to 8 hours | Until task stops |
| Infrastructure overhead | None | None | Significant |
| Cold start | 100–500ms | ~12s first / 1.86s resume | 15–90s |
| Max runtime | 15 minutes | 8 hours | Unlimited |
| Billing model | Per invocation | Per vCPU-second | Per vCPU-hour |
Lambda Functions cover roughly 80% of serverless workloads. MicroVMs are the right answer when a session carries state worth preserving — shell history, an installed toolchain, half-compiled code — and the code executing in it is not yours. Fargate remains the choice for long-running stateless workloads or anything requiring more than 32 GB of disk.
Getting Started
Creating a MicroVM image requires a single CLI command:
aws lambda-microvms create-microvm-image --name my-sandbox --code-artifact '{"uri": "s3://bucket/artifacts.zip"}' --base-image-arn arn:aws:lambda:region:aws:microvm-image:al2023-1 --build-role-arn arn:aws:iam::account:role/BuildRole --resources '[{"minimumMemoryInMiB": 2048}]'AWS executes your Dockerfile, snapshots the result, and stores the image. From there, run-microvm launches an instance, and you control the lifecycle via suspend-microvm, resume-microvm, and terminate-microvm.
The recommended architecture puts a standard Lambda function as the control plane — managing authentication and session routing — while MicroVMs handle isolated execution. The control plane calls create-microvm-auth-token to generate a short-lived JWE token per session; the client holds that token and communicates directly with the MicroVM endpoint. For a detailed breakdown of integration patterns, this guide on MicroVMs for AI agent sandboxes covers the production-grade hooks and limits.
Three Things to Know Before You Deploy
Pricing is Fargate-class, not Lambda-class. The minimum configuration (1 vCPU, 2 GB) runs roughly $3.03 per day — approximately 9x Fargate spot pricing at equivalent specs. This is the cost of managed isolation. If your use case genuinely needs VM-level isolation, that price is justified. If it does not, Lambda Functions are orders of magnitude cheaper.
ARM64 only — for now. The service launched on ARM64 exclusively. x86 workloads are blocked at launch. AWS re:Invent 2026 at the end of this month is expected to address this; plan accordingly if x86 dependencies exist in your stack.
The 8-hour lifetime cap is absolute. Total session time — including suspended periods — cannot exceed 8 hours. Long-running agent jobs must be designed with this ceiling in mind. Sessions that exceed it terminate; there is no extension mechanism. For a hands-on walkthrough of these constraints in practice, this real-world test is the most honest account available.
The Bigger Picture
Lambda MicroVMs is not just a new compute type. It is a signal about where cloud infrastructure is heading. Running AI-generated code safely was a DIY infrastructure problem in 2024. In 2026, it is a managed service. AWS is treating agent execution as a first-class workload category, and this is the infrastructure answer to match.
AWS re:Invent 2026 kicks off November 30, and Lambda MicroVMs is prominently on the serverless track alongside durable functions and Lambda Managed Instances. The Lambda family now has three members. Understanding which one your workload belongs to is the practical skill this moment requires.
