Browser-class workspace.
Microsecond
cold-starts.
A VSCode-class editor on Firecracker-isolated microVMs. Live Share pairing, prebuilt environments, terminals, ports, and a real DAP-driven step session — all wired to the same runtime exAI ships against.
Open a repository, pair on a branch, attach a step session, forward a port. The workspace boots in 612 ms P50, persists a snapshot every minute, and resumes byte-identical when you come back tomorrow. No laptop setup. No drift. No escape surface.
{
"image": "exai/node:22",
"features": {
"git": {},
"pnpm": "9.x"
},
"forwardPorts": [3000, 5432],
"postCreateCommand": "pnpm i"
}Three surfaces.
One runtime.
The workspace is not a forked Monaco. It is three first-class surfaces — editor, terminal, source control — sitting on a typed runtime layer of compute, image, storage, and network. Every line is reachable from a single keyboard shortcut.
KVM-isolated.
Snapshot-resumed.
Zero escapes.
Every workspace is a microVM. AWS Firecracker, KVM enforced, one-vCPU floor, eBPF-filtered egress. The same isolation model that runs Lambda, applied to the IDE you keep in a tab.
- One-vCPU floor.Even idle workspaces sit on a dedicated vCPU + 1 GB RAM lane. No noisy-neighbor scheduling. No bursty contention.
- KVM-isolated.Each workspace runs inside its own Firecracker microVM. KVM enforced. Container-escape surface is zero.
- Snapshot-resume.Disk + memory snapshot every 60 s to object storage. Pause for a week, resume on the same kernel state.
- Regional failover.Snapshots replicate cross-AZ. A region drain promotes the warm pool elsewhere with no operator action.
- eBPF egress filter.Outbound traffic is policy-gated per workspace. Allow-listed registries, denied-by-default exfil paths.
Open the repo.
One second later, you type.
Every push prebuilds. Image, deps, build artifacts — all warm before a human asks. The platform claims your dotfiles, your extensions, your shell. The tab opens; you write code.
Webhooks fire on every default-branch push. PRs prebuild on open + sync. Cron schedules cover sleepy repos.
From click to cursor in the editor. Image, deps, build cache, and devcontainer features are all pre-resolved.
Three-layer cache — git fetch, package manager (pnpm / yarn / cargo / pip), and build artifacts (next, turbo).
Soft + hard ceilings on prebuild minutes, parallel jobs, and storage. Spend dashboards drill to commit SHA.
The same Devcontainer spec VSCode ships. Add an exai block and the platform claims the prebuild trigger, the cache TTL, and the per-user dotfiles repo. Nothing proprietary. Nothing locked-in.
{
"name": "exai-monorepo",
"image": "ghcr.io/exai/dev-base:22-bookworm",
"features": {
"ghcr.io/devcontainers/features/git:1": {},
"ghcr.io/devcontainers/features/node:1": { "version": "22" },
"ghcr.io/exai/features/pnpm:1": { "version": "9.x" }
},
"forwardPorts": [3000, 5432, 6379],
"portsAttributes": {
"3000": { "label": "web", "onAutoForward": "openPreview" },
"5432": { "label": "postgres", "protocol": "tcp" }
},
"postCreateCommand": "pnpm install --frozen-lockfile",
"postStartCommand": "pnpm turbo run dev --filter=web",
"customizations": {
"exai": {
"prebuild": { "trigger": ["push", "pr"], "ttl": "7d" },
"dotfiles": { "repository": "git@github.com:org/dotfiles.git" }
}
}
}Stand up a workspace.
Today.
VSCode-class editor. Firecracker microVMs. Live Share pairing. Prebuilds in ≤ 1 s. The cloud workspace platform engineers actually run on — not the one their procurement team approved two years ago.