← Back to essays

A Real VM Is the Primitive for Cloud Coding Agents

·2 min read·By Ry Walker

Everyone trying to move coding agents to the cloud hits the same wall, and almost nobody names it correctly. The hard part is not the model. The hard part is replicating a developer's local environment faithfully enough that the agent can actually do its job.

Ask ten developers if their environments are identical and they will all say yes. They are wrong. Every developer customizes their local machine in small ways, and those variations are never captured. So when work gets sent to the cloud, it breaks in ways nobody anticipated. This is the single most common issue companies report when they try to operationalize cloud agents.

The obvious instinct is to reach for a container. But most legitimate dev environments already run Docker, and you cannot cleanly run Docker inside Docker. The moment your setup is even slightly real, containers stop being enough. And a coding agent that cannot install dependencies, run the test suite, open a browser, or send you a screenshot of its work is not doing engineering. It is doing a demo.

That is why a real virtual machine is the primitive here. A full operating system with persistent state that snapshots on stop and restores on resume. Not a sandbox bolted onto someone else's cloud service. A real computer in the cloud that boots the developer's own image, with their dependencies and tools baked in, every single time. This is the same reasoning behind why sandboxes beat vector RAG for code generation: the agent needs the territory, not a description of it.

There is a second reason to own this layer rather than rent it. If you lean on an AWS-specific or GCP-specific sandbox service, you have just welded yourself to one cloud. Enterprise buyers who run on-prem, who cannot touch public cloud at all, become unservable. A cloud-agnostic VM primitive that you own is the thing that lets you deploy inside any customer environment, down to bare metal in a regulated bank's data center.

The lesson for anyone building agent infrastructure: a real VM is harder to build than a container, and that difficulty is exactly the moat. Get the primitive right, and the rest of the cloud agent story becomes possible.

Key takeaways

  • Coding agents need the exact same environment as the developer's local machine, which containers cannot reliably provide.
  • The Docker-in-Docker problem means a real VM with persistent state is the actual primitive for cloud agent work.
  • A cloud-agnostic sandbox you own is a prerequisite for self-hosted enterprise deployment, not a nice-to-have.

FAQ

Why not just run a Docker container for cloud coding agents?

Most real dev environments already run Docker. Running the agent inside a container means nesting containers, and Docker-in-Docker has hard restrictions. A full VM avoids the problem and gives the agent a complete OS, terminal, browser, and the ability to run the whole app.

What does state mean in this context?

The VM boots a full Linux instance, and on stop it snapshots the entire disk. When the session resumes, all of that state is restored, so the agent picks up exactly where it left off with dependencies and tooling intact.

Tembo

Drowning in pull requests that need your review? Try Tembo Review, a beautiful AI-assisted PR review tool unlike anything you’ve used.