AWS Lambda MicroVMs で軽量なコード検証環境を作ってみた

import { exec, spawn } from "node:child_process";
import http from "node:http";

const server = http.createServer((req, res) => {
  // コマンドを実行して結果を返す
  if (req.method === "POST" && req.url === "/exec") {
    let body = "";
    req.on("data", (c) => { body += c; });
    req.on("end", () => {
      const { command } = JSON.parse(body);
      exec(command, { cwd: "/app", timeout: 600000 }, (error, stdout, stderr) => {
        res.writeHead(200, { "Content-Type": "application/json" });
        res.end(JSON.stringify({
          exitCode: error && typeof error.code === "number" ? error.code : 0,
          stdout, stderr,
        }));
      });
    });
    return;
  }
  // tar.gz を受け取り /app に展開する
  if (req.method === "POST" && req.url === "/sync") {
    const chunks = [];
    req.on("data", (c) => chunks.push(c));
    req.on("end", () => {
      const tar = spawn("tar", ["xzf", "-", "-C", "/app"]);
      tar.stdin.end(Buffer.concat(chunks));
      tar.on("close", (code) => {
        res.writeHead(200, { "Content-Type": "application/json" });
        res.end(JSON.stringify({ exitCode: code, stdout: "", stderr: "" }));
      });
    });
    return;
  }
  res.writeHead(200);
  res.end(JSON.stringify({ status: "ok" }));
});
server.listen(8080, () => console.log("listening on 8080"));

# 信頼ポリシー trust-policy.json（Lambda がこのロールを引き受けられるようにする）
{ "Version": "2012-10-17", "Statement": [{
  "Effect": "Allow",
  "Principal": { "Service": "lambda.amazonaws.com" },
  "Action": ["sts:AssumeRole", "sts:TagSession"] }] }

# 権限ポリシー build-policy.json（Amazon S3 取得と Amazon CloudWatch Logs 書き込みを許可）
{ "Version": "2012-10-17", "Statement": [
  { "Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::<your-bucket-name>/*" },
  { "Effect": "Allow",
    "Action": ["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],
    "Resource": "arn:aws:logs:*:*:*" }] }

aws iam create-role --role-name MicrovmBuildRole \
  --assume-role-policy-document file://trust-policy.json
aws iam put-role-policy --role-name MicrovmBuildRole \
  --policy-name BuildPolicy --policy-document file://build-policy.json

FROM node:24-alpine
WORKDIR /app
COPY package.json ./
RUN npm install
COPY biome.json tsconfig.json server.js ./
EXPOSE 8080
CMD ["node", "server.js"]

zip -r app.zip . -x 'node_modules/*' -x '.git/*'
aws s3 cp app.zip s3://<your-bucket-name>/app.zip

aws lambda-microvms create-microvm-image \
  --name agent-sandbox \
  --code-artifact '{"uri":"s3://<your-bucket-name>/app.zip"}' \
  --base-image-arn arn:aws:lambda:us-east-1:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::<account-id>:role/MicrovmBuildRole

aws lambda-microvms get-microvm-image --image-identifier <imageArn> --query 'state'

aws lambda-microvms run-microvm \
  --image-identifier <imageArn> \
  --idle-policy '{"autoResumeEnabled":true,"maxIdleDurationSeconds":900,"suspendedDurationSeconds":300}'

aws lambda-microvms get-microvm --microvm-identifier <microvmId> --query 'state'