# Firecracker Firecracker is a security option for building AI agents. AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. ## Facts - Layer: Security (What stops it) - Vendor: Amazon Web Services (github.com/firecracker-microvm/firecracker) - Licence: open source - Pricing: open source - Self-hostable: yes - Job within the layer: sandbox - Docs: https://firecracker-microvm.github.io/ - Last verified: 2026-08-21 ## When to reach for it - You are choosing a security component — what stops it. - You need to run it on your own infrastructure, or your procurement process requires source access. - You want to start without a commercial conversation. - Within security, it does one specific job: sandboxing. ## Worth knowing The default answer for running code a model wrote. Under 5 MiB overhead per VM, so per-task disposable sandboxes are affordable. ## Alternatives in the security layer | Option | What it does | Licence | Self-host | | --- | --- | --- | --- | | gVisor | Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. | open source | yes | | Kata Containers | MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. | open source | yes | | No isolation (host process) | The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. | open source | yes | | E2B | Firecracker sandboxes for running code the agent wrote, safely. | open source | yes | | Llama Guard | Open-weight classifier for input and output safety. Runs wherever you run it. | open source | yes | | Guardrails AI | Declarative input/output validators with a hub of prebuilt checks. | open source | yes | | NeMo Guardrails | NVIDIA's programmable rails — constrain topic, dialogue path and tool use. | open source | yes | | Lakera Guard | Prompt-injection and jailbreak detection as a low-latency API call. | proprietary | no | | Rebuff | Open-source prompt-injection detector with canary tokens. | open source | yes | | Invariant | Policy engine and analyzer for agent traces and MCP tool calls. | open source | yes | | Descope Agentic Identity | Identity, delegated consent and scoped tokens for agents acting on behalf of users. | proprietary | no | | Auth0 for AI Agents | Token vault, async user approval and fine-grained authorization for tool calls. | proprietary | no | | Oso | Authorization-as-a-service — decide what this agent may touch, per record. | open source | yes | | Microsoft Presidio | PII detection and redaction before text ever reaches a model provider. | open source | yes | | Cloudflare AI Gateway | Rate limiting, caching, spend caps and logging in front of any provider. | proprietary | no | | iron-proxy | Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. | open source | yes | Head to head: - https://newagent.build/compare/firecracker-vs-gvisor - https://newagent.build/compare/firecracker-vs-kata - https://newagent.build/compare/firecracker-vs-host-only - https://newagent.build/compare/firecracker-vs-e2b - https://newagent.build/compare/firecracker-vs-llama-guard - https://newagent.build/compare/firecracker-vs-guardrails-ai - https://newagent.build/compare/firecracker-vs-nemo-guardrails - https://newagent.build/compare/firecracker-vs-lakera ## Add it to a stack ```bash curl -fsSL "https://newagent.build/api/stack?security=firecracker&format=sh" | sh ``` ## Machine interfaces - `GET https://newagent.build/api/registry` — every component as JSON - `GET https://newagent.build/api/vendors` — vendors, with the repo and releases feed to watch - `GET https://newagent.build/api/advise?q=` — recommended stack for a description - `GET https://newagent.build/api/stack?=&format=sh|json|md|yml|agents|env` — a stack as files - `GET https://newagent.build/llms.txt` — the whole registry in one fetch Any page here also returns markdown if you send `Accept: text/markdown`.