{"slug": "show-hn-engrams-an-open-source-alternative-to-devin", "title": "Show HN: Engrams, an open source alternative to Devin", "summary": "Engrams, a self-hosted orchestrator for AI coding agents, launched as an open source alternative to Devin, running each agent in its own Firecracker microVM and snapshotting idle VMs so sessions cost nothing to keep. Engrams restores a snapshotted session in under 100 ms on the same host, one to two seconds on another host, and under a second from cold with no pre-warming, with storage deduplicated by content-addressed chunks so a thousand sessions of a 4 GiB image take about 100 GiB rather than 4 TiB. The 0.x project ships Claude Code and Codex as harnesses, deploys via one Terraform apply and two Helm releases on GKE or EKS, and is not a hosted service — users bring their own Anthropic or OpenAI key.", "body_md": "engrams is a self-hosted orchestrator for AI coding agents. It runs each agent in its own [Firecracker](https://github.com/firecracker-microvm/firecracker) microVM, snapshots the VM when the agent goes idle, and restores it when the next prompt arrives.\n\nA session is a plain OCI image plus an agent harness. You build the image with `docker build`, enable it once, and engrams boots it on a host in your own cloud, streams the transcript and tool calls to the dashboard, Slack, or the CLI, and snapshots the VM away when it goes quiet. Claude Code and Codex ship as harnesses. The pattern is the one behind hosted sandbox products like E2B, Modal Sandboxes, and Ramp's Inspect; engrams is the version you run yourself.\n\n- **It runs in your cloud.** One Terraform apply and two Helm releases bring it up on GKE or EKS, with GCS or S3 for blobs and your cloud's secret manager for credentials. No transcript, workspace, or key leaves your account.\n- **Every session is a real virtual machine.** Isolation is KVM, enforced by hardware, not a container boundary. Outbound traffic from a session goes through a filtering proxy on the host, so an agent reaches only the hosts you allow.\n- **Idle sessions cost nothing to keep.** When an agent stops talking, engrams snapshots the VM's memory and disk into content-addressed chunks and destroys the VM. The next prompt restores it: under 100 ms on the same host, one to two seconds on another host, and under a second from cold with no pre-warming.\n- **Storage is deduplicated by construction.** Chunks are keyed by their hash, so a base image is stored once no matter how many sessions use it. A thousand sessions of a 4 GiB image take about 100 GiB, not 4 TiB.\n- **Your image stays yours.** The agent runtime, the in-guest daemon, and the tools are staged by the host and mounted into the VM at boot. The image contract is any Linux image with`/bin/sh` .\n- **It is a product, not a library.** A dashboard, tasks and profiles, a CLI, 24 built-in connectors, and automations: trigger-driven pipelines of agent runs that start from a schedule, a Slack thread, a pull request, or a webhook, with a durable record of every step. Pull request review and Slack threads ship as automations you enable.\n\n- **engrams is not a hosted service.** You run it. If you want someone else to run the sandboxes, E2B and Modal do that well.\n- **engrams is not a development environment for people.** Sessions exist for agents. You can open a shell or an IDE into one, but if you want workspaces for engineers at their editors, look at Coder.\n- **engrams is not a container runner.** Production isolation is Firecracker on Linux with KVM, and there is no container mode. A macOS backend on Apple Virtualization exists for development only.\n- **engrams is not a model provider.** You bring an Anthropic or OpenAI key, or point it at a router such as OpenRouter.\n- **engrams is not finished.** It is a 0.x project that runs one company's production. Wire formats and APIs change, and it carries a fork of Firecracker that is rebased on upstream daily.\n\nThis section runs the whole stack on one machine for a first look. It is not a production shape. On an Apple Silicon Mac the sessions run under Apple's Virtualization framework; on a Linux machine with `/dev/kvm` they run under Firecracker; anywhere else they run as plain subprocesses with no isolation.\n\nIf you have Nix, `nix develop` gives you the pinned toolchain and you can skip the next block. Without Nix, on macOS:\n\n```\n# Rust per rust-toolchain.toml (https://rustup.rs), then:\nrustup target add aarch64-unknown-linux-musl\nbrew install just tilt-dev/tap/tilt jq squashfs protobuf pkg-config openssl node pnpm bun\nbrew install FiloSottile/musl-cross/musl-cross --with-aarch64\n# Docker Desktop, OrbStack, or Colima for the registry and Postgres containers.\n```\n\nOn Linux you need the same Rust toolchain, Docker, `just`, `tilt`, `jq`, and `bun`.\n\nThen, from the repo root:\n\n```\njust bootstrap     # writes a local master key to .env (once)\njust pull-kernel   # fetches the guest kernel for this machine's backend (once)\njust dev           # starts everything under Tilt\n```\n\nTilt's status page is at [http://localhost:10350](http://localhost:10350) and the dashboard is at [http://localhost:5173](http://localhost:5173). Open the dashboard and create an account; registration is open in the dev stack. In a second terminal, bake and enable the demo image:\n\n```\njust bake-demo-enable\n```\n\nThis builds the image in `deploy/demo/`, pushes it to the local registry as `localhost:5001/demo:warm-1`, enables it, and waits while engrams captures its base snapshot. That capture takes a minute or two the first time.\n\nThe agent needs a model key. In the dashboard, open Settings and either connect your Claude Code token for interactive sessions or add an org secret named `ANTHROPIC_API_KEY` for sessions started from the CLI and other automations.\n\nNow build the CLI and start a session against the demo image:\n\n``` php\n(cd cli && bun install && bun run build)      # -> cli/dist/engrams\nexport ENGRAMS_URL=http://localhost:8787\nexport ENGRAMS_API_KEY=$(cat var/dev-api-key)  # the admin key `just dev` seeds\n\nSID=$(cli/dist/engrams session create \\\n  --image localhost:5001/demo:warm-1 \\\n  --harness claude \\\n  --prompt \"List /workspace and describe what you find.\")\ncli/dist/engrams session logs \"$SID\"\n```\n\nThe log shows the agent's messages and tool calls as they happen. The same session is now in the dashboard. Leave it alone for a few minutes and it snapshots and stops; send another prompt with `engrams session prompt \"$SID\" \"...\"` and it resumes where it left off.\n\nProduction is a Kubernetes cluster with two Helm releases: the control plane (coordinator, orchestrator, web) and the Firecracker host fleet on a dedicated node pool with nested virtualization. Terraform quickstarts create the cluster, database, buckets, and secret shells for each cloud. Follow [`docs/deploy-gcp.md`](https://github.com/cortexapps/engrams/blob/main/docs/deploy-gcp.md) or [` docs/deploy-aws.md`](https://github.com/cortexapps/engrams/blob/main/docs/deploy-aws.md), and read [`docs/deploy.md`](https://github.com/cortexapps/engrams/blob/main/docs/deploy.md) for the topology and the configuration reference.\n\n```\n   dashboard · CLI · Slack · webhooks\n                 │\n        ┌────────▼────────┐        ┌─────────────────┐\n        │   orchestrator  │───────▶│   coordinator   │────▶ Postgres\n        │  auth · tasks · │        │ scheduler · idle│\n        │  integrations   │        │ eviction · events│\n        └─────────────────┘        └────────┬────────┘\n                                            │  hosts dial in\n                     ┌──────────────────────┼──────────────────────┐\n              ┌──────▼──────┐        ┌──────▼──────┐        ┌──────▼──────┐\n              │  host agent │        │  host agent │        │     ...     │\n              │ ┌────┐┌────┐│        │ ┌────┐┌────┐│        │             │\n              │ │ VM ││ VM ││        │ │ VM ││ VM ││        │             │\n              │ └────┘└────┘│        │ └────┘└────┘│        │             │\n              └──────┬──────┘        └──────┬──────┘        └─────────────┘\n                     └──────────────┬───────┘\n                          blob store (GCS · S3 · local)\n                     image chunks · memory chunks · snapshots\n```\n\nThe **orchestrator** is the product surface. It owns users and API keys, tasks and profiles, the Slack and GitHub integrations, and the Connect RPC API the dashboard and CLI call. The **coordinator** is a stateless service in front of Postgres that schedules sessions onto hosts, evicts idle ones, and fans out session events. Hosts never need an inbound port: each **host agent** dials the coordinator, registers its capacity, and runs the VMs. Inside every VM a small **in-guest daemon** starts the harness, runs commands, and moves files.\n\nStorage is the part that makes the rest cheap. Disk and memory state live as hash-keyed immutable chunks in a blob store, with versioned manifests pointing at them. A base image is materialized into chunks once when you enable it. Sessions read those chunks on demand through an NBD device and page memory in lazily with `userfaultfd`, and a snapshot writes only the chunks that changed. Restoring on a different host is a matter of fetching the delta.\n\n[`DESIGN.md`](https://github.com/cortexapps/engrams/blob/main/DESIGN.md) has the full design and the [architecture page](https://github.com/cortexapps/engrams/blob/main/site/src/content/docs/docs/concepts/architecture.md) the component and wire detail.\n\n- [`docs/deploy.md`](https://github.com/cortexapps/engrams/blob/main/docs/deploy.md) ,[` docs/deploy-gcp.md`](https://github.com/cortexapps/engrams/blob/main/docs/deploy-gcp.md) ,[` docs/deploy-aws.md`](https://github.com/cortexapps/engrams/blob/main/docs/deploy-aws.md) : production deployment.\n- [Images and harnesses](https://github.com/cortexapps/engrams/blob/main/site/src/content/docs/docs/concepts/images-and-harnesses.md) : building session images and enabling them.\n- [Warm hooks](https://github.com/cortexapps/engrams/blob/main/site/src/content/docs/docs/guides/warm-hooks.md) : running a command once at enable time so sessions start warm.\n- [Telemetry](https://github.com/cortexapps/engrams/blob/main/site/src/content/docs/docs/guides/telemetry.md) : OpenTelemetry spans for every model call and tool call.\n- [`cli/README.md`](https://github.com/cortexapps/engrams/blob/main/cli/README.md) : the` engrams` CLI.\n\n[`AGENTS.md`](https://github.com/cortexapps/engrams/blob/main/AGENTS.md) is the guide for working in this repo: the build, the test lanes, and the conventions. `just check` runs the Rust gate before a pull request.\n\nCopyright (C) 2026 Cortex Applications, Inc.\n\nengrams is free software under the GNU Affero General Public License v3.0. See [`LICENSE`](https://github.com/cortexapps/engrams/blob/main/LICENSE).\n\nThe crates a custom harness links (`engram-harness-sdk`, `engram-harness-proto`, `engram-transport`, `engram-ids`) are Apache-2.0, so your harness does not take on AGPL terms. Each of those crates carries its own `LICENSE`.", "url": "https://wpnews.pro/news/show-hn-engrams-an-open-source-alternative-to-devin", "canonical_source": "https://github.com/cortexapps/engrams", "published_at": "2026-10-01 15:34:11+00:00", "updated_at": "2026-10-01 15:48:47.782757+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-infrastructure", "artificial-intelligence"], "entities": ["Engrams", "Devin", "Firecracker", "Claude Code", "Codex", "E2B", "Modal Sandboxes", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-engrams-an-open-source-alternative-to-devin", "markdown": "https://wpnews.pro/news/show-hn-engrams-an-open-source-alternative-to-devin.md", "text": "https://wpnews.pro/news/show-hn-engrams-an-open-source-alternative-to-devin.txt", "jsonld": "https://wpnews.pro/news/show-hn-engrams-an-open-source-alternative-to-devin.jsonld"}}