The VMs Powering Mobile Agents (Instinct, Claude Code)

Mobile agents are moving off local machines onto phones, with companies like Claude Code providing VMs for them to run on. This post examines how some major platforms implement this, based on exploration of ws-term. For Claude Code on a phone, the agent runs inside a Firecracker microVM — a KVM guest with its own kernel booted into a Rust-written init.

Inside the VM, PID 1 is a Rust/Tokio binary named process_api, which mounts the disks and listens on vsock port 2024 so the host can drive the session from outside. The platform's defining trait is that this control agent lives inside the user's tenant space, so it is heavily sealed: PID 1 is non-dumpable, /proc/1/mem is denied even with CAP_SYS_PTRACE, and the shell lacks CAP_SYS_RESOURCE. Storage is split into the user's writable persistent disk (vda, 256G, mounted at /) and the vendor's read-only disks: vdc (341M /opt/claude-code) holds the 324 MB Bun-based 'claude' harness that runs tool calls, vdd (45.6M /opt/env-runner) is the task launcher, and vde/vdf are read-only skills.

The model itself runs outside the VM; inference is streamed via Server-Sent Events over HTTPS/2 to /v1/messages, through a 443-only egress gateway that is MITM'd, with api.anthropic.com pinned in /etc/hosts. There is no inbound networking (using 192.0.2.2, an RFC-5737 test address). Auth is a host-minted OAuth token cached root-only and rotated per boot. Lifecycle is host-driven: startup takes about 430 ms to init and 6.4 s until the harness process is ready; spin-up is triggered by an inbound message via vsock, and spin-down happens on idle reclaim. When reclaimed, processes die but vda detaches intact and reattaches on next cold boot, making conversations appear continuous.

The excerpt then begins to introduce Instinct, a recently launched startup that does 'some very nice thin…', but the text cuts off before providing details.