Engineering the millisecond cloud.
Deep-dives and how-tos on microVMs, Firecracker, snapshot-restore, and the infrastructure behind safe, fast AI agent execution.
898 posts
Every In-Process Python Sandbox Leaks, and the Reason Is Structural
Removing a name from a namespace removes a name, not reachability. CPython's object graph has no partitions, and `ctypes` is a documented feature whose purpose is calling arbitrary native code. Here is where the boundary actually has to go.
Debugging Inside a MicroVM: gdb, strace, and Core Dumps
A worker died at 02:14 and all I had by morning was exit code 139. Ephemeral infrastructure is hostile to debugging for four separable reasons, and each one has a countermeasure you have to put in place before the failure, not after.
Encryption at Rest for Sandbox Disks and Snapshots
"Is customer data encrypted at rest?" is one checkbox covering four very different files, three of which are not what the reviewer is picturing. One of them is a verbatim copy of someone's RAM.
Pickle Is a Virtual Machine You Have Been Downloading
pickle is a stack machine with an eval loop, and you have been downloading it from the internet as model weights. Here is the disassembly, why the allowlist promises less than it looks, and the conversion gateway that fixes it once instead of forever.
Parsing Untrusted Binary Protocols: A Length Field You Believed
Text formats fail by doing too much. Binary formats fail by arithmetic. The wire said how long something was and the parser believed it — that is the whole bug class, and the vendor SDK underneath you is not in your fuzzing corpus.
Giving an AI Agent a Language Server: The Index Is Code Execution
An agent that edits code by grepping and guessing is the agent everyone complains about. A language server fixes that — and quietly runs the repository's build scripts to do it. So run the indexer in a microVM, snapshot the warm index, and restore it per session.
AgentCore's Code Interpreter, or a Sandbox You Hold?
The question is not which sandbox boots faster. It is how much of your agent stack you want to buy as one unit — and AgentCore is a very large unit that happens to contain a code interpreter.
Where to Run devcontainer.json in 2026
devcontainer.json names an image, layers features, forwards ports and runs lifecycle commands. It has no field describing what the workspace is isolated from — so two fully compliant platforms can hand you completely different blast radii from a byte-identical file.
Top 6 Burner Postgres Platforms for Pull Requests (2026)
A scratch database for a test run dies with the process that made it. A pull-request database has to survive nine days of review, serve a preview app and a human with psql, be found again by the next CI run, and then be deleted by a job nobody owns. Six platforms, graded on the fourth one.
Top 12 Ephemeral Development Environment Platforms in 2026: The Cost of the Second One
The first ephemeral environment is a demo and every platform wins it. The second one is the product. Twelve platforms graded on idle cost, teardown semantics, whether uncommitted work survives a reap, and whether the isolation boundary is a kernel or a polite suggestion.
Top 11 Ephemeral Development Environment Platforms (2026)
Every roundup in this category sorts by substrate or by price list. Both are downstream of a question nobody asks on the evaluation call: who, or what, is going to call create? Eleven platforms sorted by their creator — human, CI job, pull-request webhook, agent API — because the creator decides how many environments exist at once and who pays for the idle ones.
Top 10 Throwaway psql Platforms for Engineers (2026)
Everyone benchmarks create latency. Nobody benchmarks the part engineers actually wait on, which is the seed. A database you can create in two seconds and must then load 40 GB into is a twenty-minute database -- so grade these ten on the provisioning verb instead.
Parsing Untrusted XML: The Format That Ships an Interpreter
An external entity is a documented feature that makes the parser read files and open sockets for whoever wrote the document. XXE is not a defect; it is conformance with the wrong author. So stop treating a flag as a boundary.
Per-Tenant Audio and DSP Rendering in MicroVMs: The Plugin Is the Payload
Audio platforms have the same shape as render farms, plus one property that changes everything: the thing a customer uploads is often not data, it is a shared library, and hosting it means loading it into your renderer's address space.
Simulating a Fleet of Devices: Digital Twins in MicroVMs
Every connected product eventually has to answer "what happens when forty thousand of these reconnect at once?" Forty thousand goroutines in one process will answer confidently and wrongly, because they share one kernel, one clock and one TLS session cache.
nftables vs iptables for Per-Sandbox Networking: Why I Still Write iptables
PandaStack writes `iptables` into 16,384 pre-allocated network namespaces, which is the unfashionable choice. The reason is that nftables' biggest win — not walking a long linear chain — is an argument about rule count, and our rule count per namespace is four. What actually hurts at fleet scale is the state nobody namespaced properly.
memory.high vs memory.max: Throttle or Kill
Hard limit and soft limit is the wrong mental model. One of these files converts an overcommit mistake into a dead process; the other converts it into a latency problem. For a multi-tenant fleet, that difference is the entire design.
Guest Writeback Throttling: Why dirty_ratio Is Wrong for a 2 GiB MicroVM
The guest is extremely confident about a disk that does not exist. The host is also confident, about different things. Between those two confidences live your tail latencies.
The Best WebAssembly Runtimes in 2026 (From a MicroVM Vendor)
I sell microVMs, which makes me the wrong person to write this and therefore obliged to write it fairly. A buyer's guide to the WASM runtimes themselves: what the artifact is, what the guest can reach, what your language actually compiles to, and what stops a while(1).
PandaStack vs Gitpod / Ona: A Workspace Is Not a Sandbox
Gitpod was right about disposable development environments before most of the industry agreed. The divergence is not quality, it is the unit: a workspace a person opens, versus a sandbox an API call creates and throws away 400 times.
Top 6 Ephemeral Dev Environment Platforms for AI Agents
Every roundup of ephemeral development environments grades them for a human opening an IDE. This one grades them for an autonomous agent with no hands, no browser and no patience — six platforms, one rubric, including where mine loses.
Top 9 Temporary PostgreSQL Database Platforms (2026)
A temporary Postgres is produced in one of four ways — a process on the runner, a schema inside somebody else's server, a copy-on-write branch, or a server of its own. The factory decides everything else, including whether your migration rehearsal means anything.
Running a Multi-Tenant Render Farm on MicroVMs: A .blend File Is a Program
If strangers send you scene files and render flags, you are not running a render farm. You are running a code-execution platform that happens to produce images, and the boundary you picked for "just rendering" is now load-bearing.
Document Conversion Is Remote Code Execution With a Progress Bar
A convert endpoint accepts an arbitrary program from a stranger and runs it with your service account and your network position. The office formats are not data. They are a feature set, and some of those features dial out.