all posts
blog · topic

Snapshots, forking and cold starts

Restoring a snapshot instead of booting from scratch is how a microVM starts in milliseconds, and copy-on-write is how one running machine becomes many. These posts cover snapshot-restore internals, forking a live VM, hibernation and scale-to-zero, and what those primitives enable for agents and tests.

Thaw: sub-second cold restore

114 posts

·11 min read

Top 14 Ephemeral Development Environment Platforms in 2026: The Resume Path Nobody Benchmarks

Every platform in this category publishes a create number. None of them publish the one you hit ten times a day: the wait after the platform decided nobody was looking. Fourteen platforms graded on what idle actually means -- stop, suspend, hibernate or destroy -- what survives it, what it costs at rest, and whether coming back is the same code path as create or a slower one nobody measured.

ephemeral-environmentsdev-environmentsscale-to-zero
Ajay Kumar
·11 min read

Per-Tenant Map Tile Rendering in MicroVMs: When Your Customers Write the Stylesheet

A map style is not configuration, it is a program: a few kilobytes of JSON that tells thirty years of C++ how much memory to allocate and which files to open. Here is what happens when one tenant writes a bad one, and the per-tenant microVM shape that keeps it their problem instead of everybody's.

map-tilesmulti-tenantmicrovm
Ajay Kumar
·11 min read

Per-Tenant Payroll and Tax Engines in microVMs: Determinism Is the Product

A payroll or tax engine is a pure function on paper and a function of fifteen undeclared arguments in production: tzdata, ICU, glibc, a rounding mode nobody chose, and the customer's own deduction formula. Then an amended return arrives three years later and asks for the same number, plus an explanation.

microvmfirecrackerpayroll
Ajay Kumar
·10 min read

Readahead Inside a microVM: The Kernel Guessing Wrong, 4 KiB at a Time

There is no disk. A guest read is a descriptor on a virtqueue, an exit to the VMM, a file read on the host, and a second page cache doing its own speculation underneath yours. Both layers are guessing about the same access pattern, and only one of them is paying for the exits.

readaheadpage-cachevirtio-blk
Ajay Kumar
·10 min read

kvm-clock vs TSC: How a Firecracker Guest Tells the Time, and What a Snapshot Does to It

A guest clock is not one thing. It is a rated list of clocksources, a shared memory page the host writes into, and a userspace fast path that silently becomes a trap when you pick wrong. Then you snapshot it, and the whole stack starts lying in a very specific way: TLS first, loudly.

firecrackerkvm-clockclocksource
Ajay Kumar
·10 min read

Firecracker vs Hyper-V Isolated Containers: Two Ecosystems, One Verdict

Microsoft shipped Hyper-V isolated containers because Windows containers on a shared kernel were not a boundary they would stand behind for other people's code. The Linux world shipped Firecracker, Kata and gVisor for exactly the same reason. Same verdict, opposite engineering — and one of them cannot run your Windows binary.

firecrackerhyper-vwindows-containers
Ajay Kumar
·11 min read

Encryption at Rest for Sandbox Disks and Snapshots

"Is customer data encrypted at rest?" is one checkbox covering four very different files, three of which are not what the reviewer is picturing. One of them is a verbatim copy of someone's RAM.

encryption-at-restsecuritysnapshots
Ajay Kumar
·11 min read

Giving an AI Agent a Language Server: The Index Is Code Execution

An agent that edits code by grepping and guessing is the agent everyone complains about. A language server fixes that — and quietly runs the repository's build scripts to do it. So run the indexer in a microVM, snapshot the warm index, and restore it per session.

ai-agentslanguage-serverlsp
Ajay Kumar
·11 min read

Letting Customers Run Their Own Container Image

“Bring your own container image” is a remote-code-execution endpoint with a product manager attached. The admission pipeline, the baked-RAM surprise, and why the escape surface you just inherited belongs to the kernel rather than to Docker.

containersocimulti-tenancy
Ajay Kumar

More posts in this topic