Engineering the millisecond cloud.
Deep-dives and how-tos on microVMs, Firecracker, snapshot-restore, and the infrastructure behind safe, fast AI agent execution.
143 posts
Sandboxing an AI Email-Triage Agent
An email-triage agent opens attachments, follows links, and does whatever the message body tells it to. Detonate each email in its own throwaway microVM, then delete it.
Running User-Uploaded Automation Scripts Safely
The moment your SaaS lets users write a "run this Python" step, you're running arbitrary strangers' code on your servers. Here's how to give each uploaded script its own throwaway microVM instead of a shared worker.
Per-Tenant Isolation for RAG and Vector Search
The scariest bug in multi-tenant RAG is the one where tenant A's question retrieves tenant B's board deck. Here's why a shared index makes it inevitable, and how a per-tenant microVM plus a dedicated pgvector database turns the tenant boundary into hardware instead of an if-statement.
Firecracker vs Microsoft Hyperlight, honestly compared
Hyperlight throws away the guest kernel to hit sub-millisecond starts for tiny WASM functions; Firecracker keeps a whole Linux guest so it can run anything. Same KVM lineage, opposite bets. Here's the fair comparison.
Firecracker Snapshot/Restore vs CRIU Checkpoint/Restore
CRIU freezes a process tree — FDs, sockets, memory — back onto a shared host kernel. Firecracker freezes the whole microVM — guest kernel included — and just doesn't tell the guest anything happened. Same idea, different layer, very different gotchas.
The Serverless Cold-Start Problem, Explained
A cold start isn't one thing — it's a stack of them: provision a sandbox, init a runtime, load dependencies, run app init, wire up the network. This is where the milliseconds actually go, a taxonomy of the standard fixes and what each one really costs, and why snapshot-restore beats warm pools economically — plus the gotchas nobody warns you about.
WASM vs gVisor vs microVM for Untrusted Code
Three dominant ways to run untrusted or AI-generated code, on three different boundaries: a capability-sandboxed wasm module, a user-space kernel intercepting syscalls, and a real hardware-virtualized guest. Here's which one fits which workload, honestly.
Build vs Buy: Rolling Your Own Firecracker Sandbox
Firecracker is a 200MB binary that boots a VM. The other 18 months of work is everything around it. Here's an honest teardown of what building a real sandbox platform costs — and where the buy line actually is.
Isolating Real-Time AI Voice Agents Per Call
A phone bot that can look up an account, run a tool, or transfer funds is executing untrusted intent in real time — one live session per call. Give each call its own ephemeral microVM, scoped to that caller, torn down when they hang up.
Building a Minimal Firecracker Guest Kernel
Firecracker boots an uncompressed vmlinux with a deliberately tiny config. Strip the drivers, filesystems, and subsystems a microVM never sees; keep virtio, the console, and the KVM guest bits. Here's the config, the boot args, and why the kernel is pinned into every snapshot.
Run AI-Agent-Built Data Pipelines in Isolated microVMs
An AI agent writes the ETL, then runs it against your real API keys and warehouse. Give each pipeline run its own throwaway microVM — scoped creds in, artifacts out, blast radius of one.
Per-Customer Cron Jobs with microVM Isolation
One customer's runaway cron shouldn't be able to page your whole on-call. Here's how to run every tenant's scheduled job in its own throwaway microVM.