Does it only work with that specific version of firecracker and only with vms with 1 vcpu?
More than the sub ms startup time the 258kb of ram per VM is huge.
Show HN: Sub-millisecond VM sandboxes using CoW memory forking
11–20 of 85 posts
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#12Mods: can we merge with https://news.ycombinator.com/item?id=47412812?
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#13Can you run this in another sandbox? Not sure why you'd want to... but can you?
Nested page tables / nested virtualization made it to consumer CPUs about a decade ago, so yes :)
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#14Nice to see this work! I experimented with this for exe.dev before we launched. The VM itself worked really well, but there was a lot of setup to get the networking functioning. And in the end, our target are use cases that don't mind a ~1-second startup time, which meant doing a clean systemd start each time was easier.
That said, I have seen several use cases where people want a VM for something minimal, like a python interpreter, and this is absolutely the sort of approach they should be using. Lot of promise here, excited to see how far you can push it!
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#15The tricky part of doing this in production is cloning sandboxes across nodes. You would have to snapshot the resident memory, file system (or a CoW layer on top of the rootfs), move the data across nodes, etc.
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#16This is how android processes work, but it's a security problem breaking some ASLR type things.
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#17Your write-up made me think of:
https://codesandbox.io/blog/how-we-clone-a-running-vm-in-2-s...
Are there parallels?
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#18Nice to see this work! I experimented with this for exe.dev before we launched. The VM itself worked really well, but there was a lot of setup to get the networking functioning. And in the end, our target are use cases that don't mind a ~1-second startup time, which meant doing a clean systemd start each time was easier. That said, I have seen several use cases where people want a VM for something minimal, like a pyt…
simonw seems like he's always wanting what you describe, maybe more for wasm though
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#19Does this need passthrough or might we be able to leverage PVM with it on a passthrough-less cloud VM/VPS?
Re: Show HN: Sub-millisecond VM sandboxes using CoW memory forking
#20The tricky part of doing this in production is cloning sandboxes across nodes. You would have to snapshot the resident memory, file system (or a CoW layer on top of the rootfs), move the data across nodes, etc.
Is this relevant?
https://codesandbox.io/blog/how-we-clone-a-running-vm-in-2-s...