all posts
blog · topic

Firecracker and microVMs

Firecracker is the virtual machine monitor behind AWS Lambda and PandaStack's sandboxes: a minimal KVM-based VMM that boots a Linux guest with its own kernel in milliseconds. These posts explain how microVMs work, how they compare with containers, gVisor and Kata, and what it takes to run them as a platform.

Firecracker microVM sandboxes

185 posts

·11 min read

Firecracker vs VMware ESXi: the Device Model Decides

Both words mean "hypervisor," and that is the last thing they have in common. ESXi's value is an enormous device model and a datacenter control plane; Firecracker's value is having neither. The whole comparison lives in that one trade.

firecrackervmwareesxi
Ajay Kumar
·10 min read

Skipping DHCP: the Firecracker boot line you actually ship

Everybody ships the same eleven-token Firecracker kernel command line and nobody measures it. Ours is four tokens plus a generated ip= that skips DHCP entirely — here is how to work out which tokens are buying you anything, and why the answer changes completely once you restore snapshots instead of booting.

firecrackerkernelmicrovm
Ajay Kumar
·11 min read

Bare metal vs cloud VMs for running Firecracker

If you run microVMs, you run a hypervisor — and the layer underneath it is an architecture decision, not a procurement detail. Nested virt taxes every exit and every page fault; bare metal hands you the machine and the pager. Here is the ledger I actually use.

firecrackerbare-metalnested-virtualization
Ajay Kumar
·10 min read

Running Firecracker Under Nomad

Nomad will happily place a Firecracker microVM on a host, restart it, and register it in Consul. It will not clone your rootfs, build your network, restore your snapshot, or notice that the guest inside your perfectly healthy VMM process has been wedged for ten minutes.

nomadfirecrackerorchestration
Ajay Kumar
·10 min read

Agent runtimes: containers vs microVMs

Nearly every open-source coding agent converged on the same runtime: a long-lived container holding a workspace, a shell, and an action server. That design is right about the shape and optimistic about the boundary.

ai-agentsagent-runtimecontainers
Ajay Kumar
·10 min read

BuildKit vs Kaniko vs microVMs for Untrusted Image Builds

Every image builder is a code-execution engine wearing a build tool's clothes. Here is the honest comparison of the three ways teams solve that.

comparisonbuildkitkaniko
Ajay Kumar
·10 min read

Ephemeral Jenkins Agents on Firecracker MicroVMs

An eight-year-old build agent is a museum with a Jenkinsfile. Here is how to give every build a fresh microVM instead — EC2-plugin freshness at container-plugin latency.

jenkinsci-cdmicrovm
Ajay Kumar
·10 min read

How to monitor a sandbox fleet: the metrics and alerts that actually catch problems

Most sandbox dashboards measure the wrong thing. Here are the six signals that have actually paged me for a real problem, the PromQL behind them, and the ones I deleted.

observabilityprometheusmicrovms
Ajay Kumar
·9 min read

Running npm install in a MicroVM: Dependency Installation Is Arbitrary Code Execution

A postinstall script is an unsigned contract you agreed to by typing eight characters. Here is how to run dependency installation in a disposable microVM — and how snapshot forking makes it cheaper than what you do today.

supply-chain-securitymicroVMsCI/CD
Ajay Kumar

More posts in this topic