Skip to content

feat(eve): sandbox - add AWS Lambda MicroVM backend#208

Draft
AndrewBarba wants to merge 1 commit into
mainfrom
barba/aws-lambda-microvm-sandbox
Draft

feat(eve): sandbox - add AWS Lambda MicroVM backend#208
AndrewBarba wants to merge 1 commit into
mainfrom
barba/aws-lambda-microvm-sandbox

Conversation

@AndrewBarba

Copy link
Copy Markdown
Collaborator

Summary

  • add the explicit eve/sandbox/aws-lambda backend for AWS Lambda MicroVMs
  • provision content-addressed ARM64 images and application-scoped templates during prewarm
  • run sandbox process and filesystem operations through an eve-owned controller
  • persist full writable-filesystem checkpoints through S3 multipart uploads, manifests, and leases
  • generalize sandbox backend provisioning metadata and build-time prewarm behavior
  • vendor the required AWS clients without adding runtime dependencies
  • document IAM, networking, lifecycle, checkpoint, and operational requirements

Why

AWS Lambda MicroVMs provide isolated sandboxes with lifecycle control, native suspend/resume, and authenticated HTTP ingress. This makes them suitable as an explicit eve sandbox backend when durable full-filesystem state is retained outside the eight-hour MicroVM lifetime.

Impact

The backend is opt-in and does not change default backend selection. Users provide existing IAM roles, a same-region S3 bucket, and optional network connectors. Runtime network policy remains immutable after launch.

Validation

  • pnpm test:unit
  • pnpm test:integration
  • pnpm build
  • pnpm test:scenario
  • EVE_RUN_AWS_MICROVM_CONTROLLER_SCENARIOS=1 pnpm --filter eve exec vitest run --config vitest.scenario.config.ts src/execution/sandbox/bindings/aws-lambda-microvms/controller.scenario.test.ts
  • pnpm typecheck
  • pnpm lint
  • pnpm fmt
  • pnpm guard:invariants
  • pnpm docs:check
  • git diff --check

Not completed locally

  • Live AWS acceptance was not run because this environment has no AWS credentials.
  • e2e/fixtures/agent-tools-sandbox was attempted, but all cases stopped before assertions because AI Gateway/OIDC credentials are unavailable.

Signed-off-by: Andrew Barba <barba@hey.com>
@vercel

vercel Bot commented Jun 23, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
eve-docs Ready Ready Preview, Comment, Open in v0 Jun 23, 2026 2:53pm

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​aws-sdk/​client-lambda-microvms@​3.1075.07910010090100
Addednpm/​@​aws-sdk/​client-s3@​3.1073.09910010098100
Addednpm/​@​aws-sdk/​s3-request-presigner@​3.1073.010010010098100

View full report

@github-actions

Copy link
Copy Markdown
Contributor

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

  • Package delta: tarball 3.29 MB -> 3.68 MB (+394.6 kB ⚠️); install footprint 52.06 MB -> 53.38 MB (+1.32 MB ⚠️).

Delta vs main (1bbcfd3)

Area Metric Baseline Current Delta
Package Packed tarball 3.29 MB 3.68 MB +394.6 kB ⚠️
Package Unpacked publish size 11.85 MB 13.17 MB +1.32 MB ⚠️
Package Installed footprint 52.06 MB 53.38 MB +1.32 MB ⚠️
Package Published files 2239 2285 +46
Package Installed files 5444 5490 +46
Runtime Unique function payloads 2 2 0
Runtime Total function bytes 9.35 MB 9.35 MB +920 B ⚠️
Runtime Public routes 9 9 0
Changed function payloads vs main (1bbcfd3) (2)
Function Status Baseline Current Delta Route changes
functions/.well-known/workflow/v1/flow.func changed 5.48 MB 5.48 MB +772 B ⚠️ none
functions/__server.func changed 3.87 MB 3.87 MB +148 B ⚠️ none
Build Metadata
  • Preset: vercel
  • Nitro: nitro@3.0.260610-beta
  • Output directory: apps/fixtures/weather-agent/.vercel/output
  • Build metadata timestamp: 2026-06-23T14:53:48.281Z
  • Route aliases: 9 public, 1 internal (10 total aliases)
  • Vercel routes in config: 10
  • Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small
Package Drill-Down

Package Details

  • Package: eve@0.13.1
  • Package directory: packages/eve
  • Tarball: 3.68 MB (eve-0.13.1.tgz)
  • Unpacked payload: 13.17 MB across 2285 published files
  • Installed footprint: 53.38 MB across 5490 installed files
  • Installed root package: 12.06 MB
  • Installed dependencies: 41.32 MB
  • Runtime dependencies: 1
  • Peer dependencies: 12 (11 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.

Heavy installed dependencies

  • @rolldown/binding-linux-x64-gnu: 20.61 MB (38.6%)
  • eve: 12.06 MB (22.6%)
  • ai: 6.20 MB (11.6%)
  • zod: 4.97 MB (9.3%)
  • nitro: 2.41 MB (4.5%)
Publish payload breakdown
Published file size
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [####....................] 1.51 MB 11.4%
🟡 dist/src/compiled/@workflow/core/runtime.js      [##......................] 775.4 kB 5.9%
🟡 dist/src/compiled/@vercel/sandbox/index.js       [##......................] 632.0 kB 4.8%
🟡 dist/src/compiled/@aws-sdk/client-s3/index.js    [#.......................] 535.3 kB 4.1%
🟡 dist/src/compiled/@aws-sdk/client-lambda-micr... [#.......................] 481.1 kB 3.7%
🔴 Other published files                            [########################] 9.24 MB 70.2%
Installed footprint breakdown
Installed package size
🔴 @rolldown/binding-linux-x64-gnu [########################] 20.61 MB 38.6%
🔴 eve                             [##############..........] 12.06 MB 22.6%
🔴 ai                              [#######.................] 6.20 MB 11.6%
🟠 zod                             [######..................] 4.97 MB 9.3%
🟠 nitro                           [###.....................] 2.41 MB 4.5%
🟡 rolldown                        [#.......................] 771.0 kB 1.4%
🔴 Other installed packages        [#######.................] 6.37 MB 11.9%
Runtime dependencies (1)
Package Range Notes
nitro 3.0.260610-beta
Peer dependencies (12)
Package Range Notes
@opentelemetry/api ^1.0.0 optional peer
@sveltejs/kit ^2.0.0 optional peer
ai catalog:
braintrust ^3.0.0 optional peer
just-bash ^3.0.0 optional peer
microsandbox ^0.5.0 optional peer
next ^16.0.0 optional peer
nuxt ^4.0.0 optional peer
react ^19.0.0 optional peer
svelte ^5.0.0 optional peer
vite ^8.0.0 optional peer
vue ^3.5.0 optional peer
Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 5.48 MB 58.6%
🔴 functions/__server.func                         [#################.......] 3.87 MB 41.4%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 5.48 MB
Metric Value
Public routes /.well-known/workflow/v1/flow
Runtime nodejs24.x
Handler index.mjs
Payload 5.48 MB
Function files 5.48 MB across 27 files
Traced dependencies 0 B
Signal 🟠 Bundled file __eve_nitro_handler__.mjs is 1.51 MB (27.6%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 __eve_nitro_handler__.mjs              [########################] 1.51 MB 27.6%
🟠 _chunks/runtime.mjs                    [###############.........] 958.4 kB 17.5%
🟡 _chunks/sandbox.mjs                    [############............] 766.0 kB 14.0%
🟡 _chunks/attribute-changes-Bi5DLT8S.mjs [########................] 472.2 kB 8.6%
🟡 _chunks/dist-DTchiX0N.mjs              [#######.................] 460.6 kB 8.4%
🟠 Other bundled files                    [#####################...] 1.31 MB 23.9%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "environment": {
    "NODE_OPTIONS": "--experimental-require-module",
    "WORKFLOW_QUEUE_NAMESPACE": "eve"
  },
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ]
}

🟠 functions/__server.func • 8 public routes, 1 internal alias • 3.87 MB
Metric Value
Public routes /
/eve/v1/callback/[token]
/eve/v1/connections/[name]/callback/[token]
/eve/v1/health
/eve/v1/info
/eve/v1/session
/eve/v1/session/[sessionId]
/eve/v1/session/[sessionId]/stream
Internal aliases /__server
Runtime nodejs24.x
Handler index.mjs
Payload 3.87 MB
Function files 3.87 MB across 21 files
Traced dependencies 0 B
Signal 🟠 Bundled file index.mjs is 1.40 MB (36.3%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                              [########################] 1.40 MB 36.3%
🟠 _chunks/runtime.mjs                    [###############.........] 875.8 kB 22.6%
🟠 _chunks/sandbox.mjs                    [#############...........] 766.0 kB 19.8%
🟡 _chunks/attribute-changes-Bi5DLT8S.mjs [########................] 448.5 kB 11.6%
⚪ _libs/zod.mjs                          [##......................] 114.2 kB 3.0%
🟡 Other bundled files                    [####....................] 258.8 kB 6.7%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant