Blog · Guide · 28 October 2026

Self-host AEGIS with Firecracker: the setup the docs describe, and what runs today

Disclosure: 100monkeys.ai builds AEGIS, so read this guide as a maker's account. It was drafted by one of our AI agents from the public AEGIS documentation, chiefly Firecracker Deployment, What are Agents?, Infrastructure Requirements and Podman Deployment, and reviewed by the company. Every command and configuration block is copied from those pages. We ran none of them for this guide.

AEGIS by 100monkeys.ai, in beta, is a self-hosted orchestrator for autonomous agents. Its docs describe Firecracker microVMs as the isolation for hardened production. Read the first line of that page before you buy hardware: "Firecracker support is planned for a future release and is not yet available. The Docker and Podman runtimes are the current deployment targets." This guide covers what you can do today: check a host, read the configuration the docs document for the planned runtime, and run the Podman path that ships now.

Why Firecracker, in the docs' words

"Docker containers share the host kernel: a container escape vulnerability could give a malicious prompt-injected agent code execution on the host. Firecracker provides hardware-level isolation via KVM." The page's comparison gives each agent "a dedicated guest kernel per agent", a blast radius on escape "bounded to single microVM", and storage over virtio-fs, "shared memory, no network", where containers use NFS. The trade it states is a boot of about 125 ms against about 100 ms for a container.

The design keeps agents unchanged across runtimes: "Switching a node from Docker to Podman or Firecracker requires only a config change: no agent manifest changes needed." That is why preparing now is not wasted work.

Step 1. Check the host for KVM

Firecracker needs KVM, which the docs say means "bare-metal Linux servers with Intel VT-x or AMD-V CPU virtualization extensions", or cloud instances that are bare metal or have nested virtualization. It is "NOT supported on standard EC2 instances without bare-metal, most VMs (including standard VMs on most cloud providers), and macOS (Docker Desktop)." The docs' checks, copied:

# Check for KVM device nodes
ls -la /dev/kvm

# Verify CPU virtualization extensions
grep -cw vmx /proc/cpuinfo   # Intel (should return > 0)
grep -cw svm /proc/cpuinfo   # AMD  (should return > 0)

If /dev/kvm is missing on a cloud VM, that host will not run the Firecracker runtime when it ships, whatever else it has.

Step 2. Check the kernel

Run uname -r and compare it with the docs. Two pages give two minimums: What are Agents? lists "Bare-metal or KVM-passthrough host, Linux kernel 5.10+", and Infrastructure Requirements lists "Linux kernel 5.15+" with "KVM support for Firecracker (planned later phase)". Plan for 5.15 or later and you satisfy both.

Step 3. Read the configuration the docs document

The planned runtime is configured in aegis-config.yaml under runtime.firecracker. The page's block, copied:

runtime:
  type: firecracker
  firecracker:
    # Path to the jailer binary
    jailer_binary: /usr/local/bin/jailer
    # Path to the Firecracker VMM binary
    firecracker_binary: /usr/local/bin/firecracker
    # User/group for the jailed process
    uid: 65534   # nobody
    gid: 65534
    # Kernel image for microVMs
    kernel_image_path: /opt/aegis/vmlinux
    # Root filesystem for agent microVMs (minimal Linux + Python)
    rootfs_path: /opt/aegis/agent-rootfs.ext4
    # CPU and memory limits
    vcpu_count: 2
    mem_size_mib: 512
    # cgroup version (v1 or v2)
    cgroup_version: v2

Read it for what it asks of the host: a jailer and a Firecracker binary, an unprivileged uid and gid, a guest kernel image, an agent root filesystem, and per-VM CPU and memory. The jailer "drops privileges before starting the VMM": a chroot jail, a pre-created tap interface and cgroup, and seccomp filters. Each microVM gets its own tap device, and "outbound traffic from the microVM is routed through the orchestrator proxy (SEAL), not directly to the internet."

Do not deploy this block today. The docs do not say where the kernel image and root filesystem come from, and the runtime that reads them is described as "in development".

Step 4. Run AEGIS today on Podman

For production now, the docs point to the aegis-deploy repository: "aegis-deploy is the recommended production deployment path. It includes OpenBao (secrets management), TLS via Caddy, and full observability." Its quick start, copied:

# Clone the deployment repo
git clone https://github.com/100monkeys-ai/aegis-deploy.git
cd aegis-deploy

# Copy and edit environment configuration
cp .env.example .env
# Edit .env with your values (GHCR credentials, passwords, LLM API keys)

# Install system dependencies (Ubuntu)
make setup

# Authenticate with GitHub Container Registry
make registry-login

# Generate SEAL signing keys
make generate-keys

# Deploy the full stack
make deploy PROFILE=full

# Validate all services are healthy
make validate

# Bootstrap secrets
make bootstrap-secrets

Podman runs agents rootless, which the docs credit with eliminating "the privileged daemon" and mapping container root "to an unprivileged host UID". For evaluation on one machine, the one-line installer printed on 100monkeys.ai is curl -fsSL https://get.100monkeys.ai | bash, which brings up the local Docker stack; the docs mark that stack as "for local testing and evaluation only".

Step 5. Keep the switch to a config change

Write your agent manifests without pinning isolation, so the node decides. The manifest field isolation accepts inherit, firecracker, docker and process, and its default is inherit, "from node config". The configuration reference's example sets the node's default_isolation to docker, a value that "works with both Docker and Podman runtimes". When Firecracker ships, the change is the node's, not each agent's.

Step 6. Follow the work

The page ends: "Monitor progress on Firecracker support in the aegis-orchestrator GitHub repository." That is where a release that ships the runtime will be named.

What the docs leave open

A date or version for Firecracker support.
Where the guest kernel (vmlinux) and the agent root filesystem come from, and how to build them.
The minimum kernel: 5.10 on one page, 5.15 on another.
Other pages still describe Firecracker as the hardened production runtime without the "not yet available" warning, so read the Firecracker page itself as the current word.

To install the evaluation stack and run a first agent behind an approval, read Install AEGIS on a fresh Ubuntu VPS and run your first approved task.

Install AEGIS from 100monkeys.ai