5 comments

  • crawshaw 18 minutes ago
    Nice to see this work! I experimented with this for exe.dev before we launched. The VM itself worked really well, but there was a lot of setup to get the networking functioning. And in the end, our target are use cases that don't mind a ~1-second startup time, which meant doing a clean systemd start each time was easier.

    That said, I have seen several use cases where people want a VM for something minimal, like a python interpreter, and this is absolutely the sort of approach they should be using. Lot of promise here, excited to see how far you can push it!

  • diptanu 12 minutes ago
    The tricky part of doing this in production is cloning sandboxes across nodes. You would have to snapshot the resident memory, file system (or a CoW layer on top of the rootfs), move the data across nodes, etc.
  • vmg12 45 minutes ago
    Does it only work with that specific version of firecracker and only with vms with 1 vcpu?

    More than the sub ms startup time the 258kb of ram per VM is huge.

  • jauntywundrkind 43 minutes ago
  • handfuloflight 1 hour ago
    Can you run this in another sandbox? Not sure why you'd want to... but can you?
    • Teknoman117 43 minutes ago
      Nested page tables / nested virtualization made it to consumer CPUs about a decade ago, so yes :)
    • wmf 57 minutes ago
      It's pretty common to run VMs within containers so an attacker has to escape twice. You can probably disable 99% of system calls.