Engineering the millisecond cloud.
Deep-dives and how-tos on microVMs, Firecracker, snapshot-restore, and the infrastructure behind safe, fast AI agent execution.
245 posts
Build a Headless Browser Screenshot Service on MicroVMs
A headless browser is a loaded gun that renders JavaScript. Run each screenshot/PDF/OG-render job in a throwaway Firecracker microVM with locked-down egress, and let it die after the shot.
Per-Tenant Log Parsing Isolation on microVMs
A tenant-supplied regex with nested quantifiers is a denial-of-service attack you shipped to yourself. Run each tenant's parse pass in its own capped microVM and the blast radius stops at one VM.
Run Code-Migration Agents in MicroVMs, Not on Your CI Box
Your migration agent clones a repo, runs npm install (arbitrary postinstall = RCE), builds, and runs the tests — on a loop. That's untrusted code at full trust. One microVM per run, then fork to try N strategies.
Firecracker vs Cloudflare Containers: which model?
Cloudflare Containers put real containers on the edge, wired to Durable Objects and the Workers ecosystem. Firecracker gives you a hardware-isolated microVM you own end to end. Here's the honest head-to-head.
The Best Modal Alternatives in 2026
A 2026 field guide to Modal alternatives — PandaStack, E2B, Daytona, Runpod, Beam Cloud, Northflank, Fly.io, and the OSS Firecracker/gVisor building blocks — with decision criteria and honest 'pick this when…' calls.
How Firecracker Restores Guest Memory: mmap & MAP_PRIVATE
On restore, Firecracker mmaps the guest's whole RAM image (vm.mem) MAP_PRIVATE and resumes — so the restore lies to the guest: all its RAM is 'there,' none of it is loaded yet. Pages fault in lazily on first touch. Here's the exact kernel mechanics, and why it makes restore O(1) and many VMs share memory.
Guest Clocks and the TSC After a Firecracker Restore
Restore a snapshot a day later and the guest wakes up convinced it's still last Tuesday — and every HTTPS handshake now disagrees. Here's how guest time actually works, why it freezes on restore, and how to unfreeze it.
Firecracker's vsock-over-UDS Handoff, Explained
Firecracker exposes the guest's vsock device to the host as a plain Unix socket on disk. Here's the concrete mechanism — the CONNECT handshake, the uds_path_<port> naming for guest-initiated connections, why it beats a TCP port for a control channel, and the v1.16 per-restore UDS override that stops concurrent restores from colliding.
Best Firecracker Networking Tools & Approaches (2026)
Firecracker hands you a TAP device and a firm handshake; the rest of the network is your problem. This is a 2026 field guide to the building blocks that solve it — TAP + bridge, per-VM netns + veth + iptables NAT, CNI plugins, vhost-net for throughput, the built-in rate limiter, MMDS for metadata, egress firewalling, and pre-allocated netns pools for fast create — with a 'reach for this when…' per approach.
Restoring a Firecracker Snapshot on a Different CPU
A guest freezes its CPU feature detection at boot. Restore that frozen belief on silicon that lacks a feature and it eventually issues an instruction the new host has never heard of — and the illegal-instruction trap has opinions. A CPU template is how you make the snapshot portable instead.
Isolating CI Build Caches Per-Job with MicroVMs
Your build cache is a shared mutable global variable that ships to production. Here's how per-job microVMs give you the cache hit-rate without the cross-job poisoning.
Sandbox ffmpeg: Per-Job microVMs for Transcoding
A malformed .mkv is a remote code execution request wearing a home-video costume. Here's how to run untrusted ffmpeg jobs in a disposable microVM instead of on your host.