AWS Lambda MicroVMs: Isolated Execution for Multi-Tenant Workloads

What's new

AWS has introduced Lambda MicroVMs, a new serverless compute primitive designed for executing user-supplied or AI-generated code. This service provides VM-level isolation, ensuring that each execution environment is fully sandboxed. Key features include near-instant launch and resume speeds, along with the ability to preserve the state of an execution environment for up to eight hours. The technology is built upon Firecracker virtualization, which already underpins the standard Lambda function runtime. Lambda MicroVMs are initially available in several key AWS regions, including US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland).

Why it matters

This release addresses a significant challenge for developers building multi-tenant applications that need to run untrusted code, such as interactive coding environments, data analytics platforms, or AI coding assistants. Historically, balancing strong isolation, fast startup times, and state retention for these workloads required complex architectural trade-offs or custom virtualization management. Lambda MicroVMs eliminate this compromise, offering all three capabilities out of the box.

The ability to provide each user or job with its own isolated compute environment drastically reduces the risk of security vulnerabilities or performance impacts from one tenant affecting another. Furthermore, the state preservation feature is a critical differentiator, enabling more sophisticated, long-running interactive sessions without the overhead of cold starts or re-initializing application state. This simplifies the development and operational burden for secure, high-performance multi-tenant applications.

How to use it

Developers can get started by creating a MicroVM image from a standard Dockerfile, then launching individual MicroVMs, each accessible via a dedicated HTTPS URL that supports protocols like HTTP/2, gRPC, and WebSockets.