Nehemiah: on-demand Linux computers for AI agents

What we built

Nehemiah is open-source infrastructure for handing an AI a real computer. Each machine is a genuine Firecracker microVM, a full Linux machine with its own kernel, that boots in milliseconds, does its work, and self-destructs when it's done (or stays up as long as you want).

Every machine comes with everything an agent needs: a full Linux desktop with a real browser over VNC (or a fast headless shell), a terminal with coding agents preinstalled (claude, codex, cursor, pi), plus Node, Python, git, and internet access. You can drive it yourself, or hand the whole thing to an AI: say "build a snake game" and it writes the code, runs it, and gives you a live URL to play.

How it's built

• Hard isolation by default. Firecracker microVMs give each workload its own kernel, the same isolation technology AWS Lambda runs on, rather than containers sharing a host. For agent workloads that browse the web and execute arbitrary code, that boundary matters.
• Live-state forking. A running machine can be cloned, exact memory and disk state included, in roughly 35 milliseconds, which makes checkpoint-and-branch agent workflows practical.
• Persistent volumes, S3-backed, that outlive any individual machine, with ephemeral-by-default TTLs so nothing runs longer than intended.
• A security-conscious supply chain. Hosts are provisioned from signed release artifacts onto machines the control plane enrolls, with a one-use enrollment grant and a WireGuard overlay, not from ad hoc source builds.
• Open interfaces. A full REST + WebSocket API, plus an MCP server so any AI assistant can request and drive machines directly.

Why it matters

Agent infrastructure is where AI meets the standards enterprises and government teams actually hold: isolation, auditability, controlled provisioning. Nehemiah is that thinking in public, Apache-2.0 licensed and self-hosted with your own keys, and it's the same engineering discipline we bring to client systems.