What it is
Isolated AI Agent Execution Platform using Firecracker MicroVMs with persistent overlay filesystems.
Nsys Cortex allows an AI agent to run arbitrary code, install tools, and have those tools persist across VM restarts within a sandbox called a Neuron.
Why MicroVMs
AI agents execute untrusted code. Docker containers share the host kernel and have a history of escape vulnerabilities. Firecracker MicroVMs are designed to provide hardware-level isolation via KVM — each agent getting its own kernel with a minimal attack surface, ~125ms boot time, ~5MB memory overhead, and native snapshot/restore support. This is the target architecture; the Firecracker path is not yet production-ready (see the security note above).
Terminology
| Term | Description |
|---|---|
| Cortex | The host-side orchestrator that manages Neurons |
| Neuron | A sandboxed execution environment (MicroVM, Docker container, or dev-mode process) |
| Overlay | Persistent filesystem layer — changes survive Neuron restarts |
| Vsock | Virtual socket for host-guest communication (Unix sockets in dev + docker modes) |
Three ways to run
- Firecracker — Linux only
- The target architecture: hardware-level isolation via KVM, each agent getting its own kernel with a minimal attack surface. Its hardening is in code but has not been validated on a Linux + KVM host yet — until the validation checklist passes, run only trusted workloads.
- Docker — any platform with Docker
- Docker mode runs the agent in a hardened container (non-root, all capabilities dropped, read-only image, resource caps) — a real, kernel-sharing boundary that works on Linux, and on macOS/Windows through Docker Desktop. The default mode is auto: Docker when a daemon and the neuron image are present, else dev.
- Dev mode
- A plain process on the host, for development on any platform. It is NOT a security boundary — the agent runs as your user — so it must be acknowledged.