AWS Lambda MicroVMs Hands-On Workshop

Your AI agent just wrote code. Where do you run it — safely? Would you run code you didn't write on a shared kernel — with the same access to your files, network, and credentials that you have? For AI-generated code, that's a boundary you may not want to bet on.

AWS Lambda MicroVMs give every workload its own Firecracker virtual machine: hardware-level isolation, its own kernel and full OS, near-instant launch from a snapshot, and no compute charges while suspended. The same pattern secures any untrusted code — a contributor's CI job, a per-tenant SaaS workload — but it starts with the one you came for.

In this free, hands-on workshop you'll build that sandbox yourself and leave with patterns you can apply to your own systems.

Who this is for: engineers building AI-agent execution, CI/CD, or multi-tenant platforms who need real isolation without managing servers. Comfortable in the AWS Console and a CLI, familiar with serverless basics.

What you'll build

You start with a foundation module, then choose the use cases that fit your work — they're independent, so you can do one, two, or all three.

• Getting Started (start here, ~30–45 min) — Build a custom MicroVM image with a Dockerfile, launch your first MicroVM, and run code inside it over HTTP. This is the foundation every use case builds on.

Then pick whichever apply:

• Event-Driven Coding Agents (~45–60 min) — A pull request triggers an ephemeral MicroVM that runs an AI coding agent (Claude Code or optional Kiro) over the diff, posts a review back, and tears itself down.
• Ephemeral CI/CD Runners (~45–60 min) — A push launches a single-use MicroVM that runs your pipeline in a clean environment, reports pass/fail, and self-terminates — no runner fleet, no state between builds.
• Multi-tenant SaaS (~45–60 min) — Give each customer their own MicroVM behind a control plane that launches, caches, and routes per-tenant instances — silo isolation with on-demand economics.

You'll leave knowing when to reach for a MicroVM over a container or regular Lambda, and with the core building blocks — images, snapshots, network connectors, secrets handling, and the launch/suspend/resume/terminate lifecycle — to apply it to your own systems.