all posts
blog · topic

Snapshots, forking and cold starts

Restoring a snapshot instead of booting from scratch is how a microVM starts in milliseconds, and copy-on-write is how one running machine becomes many. These posts cover snapshot-restore internals, forking a live VM, hibernation and scale-to-zero, and what those primitives enable for agents and tests.

Thaw: sub-second cold restore

108 posts

·11 min read

Encryption at Rest for Sandbox Disks and Snapshots

"Is customer data encrypted at rest?" is one checkbox covering four very different files, three of which are not what the reviewer is picturing. One of them is a verbatim copy of someone's RAM.

encryption-at-restsecuritysnapshots
Ajay Kumar
·11 min read

Giving an AI Agent a Language Server: The Index Is Code Execution

An agent that edits code by grepping and guessing is the agent everyone complains about. A language server fixes that — and quietly runs the repository's build scripts to do it. So run the indexer in a microVM, snapshot the warm index, and restore it per session.

ai-agentslanguage-serverlsp
Ajay Kumar
·11 min read

Letting Customers Run Their Own Container Image

“Bring your own container image” is a remote-code-execution endpoint with a product manager attached. The admission pipeline, the baked-RAM surprise, and why the escape surface you just inherited belongs to the kernel rather than to Docker.

containersocimulti-tenancy
Ajay Kumar
·11 min read

A Real Red-Green Loop for Coding Agents, One MicroVM per Attempt

The single highest-signal tool you can hand a coding agent is a test runner it can actually run. Here is the two-layer architecture that makes the loop fast enough to use, the output format a model can read, and the limits the loop exists to discover you forgot.

ai-agentstddtesting
Ajay Kumar
·11 min read

Audit Trails When the Machine Is Gone in 200 Milliseconds

The thing that makes a sandbox safe — it is destroyed — is exactly what makes "what did the agent do at 03:14?" unanswerable. You cannot keep the machine. You can keep its memory and disk.

audit-loggingforensicscompliance
Ajay Kumar
·11 min read

Running MATLAB and Octave Workloads in Isolated microVMs

Most runtime isolation problems are technical. This one starts with a contract: you cannot fan out 200 MATLAB processes without the entitlements to match. Here is the honest version — licence manager, MATLAB Runtime, Octave's real compatibility cliff, and why the guest boundary wants to be a VM.

matlaboctavenumerical-computing
Ajay Kumar
·11 min read

Self-Hosting a Compiler Explorer: Running Strangers' Compilers Safely

"I'm not running their code, I'm only compiling it" is the most expensive sentence in this genre. A compiler is a programmable machine with a filesystem, a plugin loader and an unbounded appetite for RAM — and on a compiler explorer, the flags are user input too.

compiler-exploreruntrusted-codemicrovm
Ajay Kumar
·11 min read

Mutation Testing at Scale: Thousands of Broken Builds on Purpose

A test suite is a claim: that if this code were wrong, something here would fail. Mutation testing is the only honest way to check that claim — break the code on purpose, thousands of times, and see what the suite notices. Which makes it a scheduling problem.

mutation-testingtestingci
Ajay Kumar
·11 min read

One microVM per Attendee: Hands-On Labs for a Whole Room at Once

Two hundred people arrive inside the same ninety seconds, all do the same thing at the same time, and all vanish at 5pm. That load shape breaks pre-provisioning in both directions — and it is exactly what snapshot-restore-per-create is for.

training-labsworkshopsmicrovm
Ajay Kumar

More posts in this topic