We have this page which compares a whole bunch of sandbox providers in different categories
https://engine.build/lab/agent-sandboxes
Will add MicroVMs there today (and any others that are missing if you let me know!)
MicroVMs: Run isolated sandboxes with full lifecycle control
51–60 of 222 posts
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#52What's the best provider to self-host Firecracker? I feel that AWS is not a safe or cost-effective option for a self-funded startup or small business. Although is anything cost effective anymore? Hetzner just had a massive price hike. Part of it might just be that I am old and inflation is catching up with my understanding of prices. But as far as AWS I still have to say no thanks. Imagine some group actually started…
Why do you want to self-host vs. using one of the many providers out there? Daytona, E2B, OpenComputer, Freestyle, Blaxel, Vercel, Modal, Cloudflare, Tensorlake, Superserve, etc. etc. Some of them work by pre-purchasing credits, so you can control the blast radius of spend. Also, if you want a more embedded sandbox runtime as a library instead of a daemon + REST API, you can check out libkrun (and friendly layers on…
self host = better spec machine for same price.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#53> Containers launch in seconds, yet their shared-kernel architecture requires significant custom hardening to safely contain untrusted code That's literally why they made Fargate. It's managed firecracker VMs with containers. They invented firecracker for this purpose. This new product is competing with Fargate, but they don't mention Fargate at all in the announcement. > you create a MicroVM Image by supplying a Doc…
Fargate does not use Firecracker, it is simply ec2 instances.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#54What's the point of microVMs for running agents? Are you guys literally spinning up agents where a 100 ms boot time vs a 3 seconds boot time makes a difference? I'm asking because I understand the appeal of micro VMs but every time the subject comes up people talk about "isolating agents": what's wrong about isolating agents in a regular VM (or in a container which, itself, is in a VM)? FWIW I've got my stuff nicely…
This is for people who want both faster execution, and better security isolation for agents/subagents. It is a different use case than yours
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#55Earlier quoted context omitted.
> Didn't mean to highjack for self advertisement. > > As the topic matches, .... my project might be appealing to some here That's exactly what you intended to do. That is the definition of advertising. It is true, many people might like it, so own it. Don't lie about it, even to yourself.
.
Can you provide a link to your project? Self-plugs are fairly common around here, and usually appreciated (or at least not frowned upon) when it comes with juicy source code.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#56> MicroVMs support up to 8 hours of total runtime Does this mean you effectively can't use them as long-lived developer environments? It sounds like even if you suspend them, this is the hard limit on the total time it can run.
It just a time limit of the life of a single MicroVM. Using this for a long lived "developer environment" would be extraordinarily expensive anyhow. Scaling the vCPU + RAM cost of these to the same shape compute optimized Graviton On-Demand EC2 instance (16 vCPU x 32 GB RAM) shows about 4x the cost. So don't do that. Just use an EC2 instance.
But these have near instant suspended/resume, and they even have vertical scaling of the ram, which is a great feature that’s not very common.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#57How does this compare to Fly.io Which is more cheaper for me? Ideally maybe self hosting would be better?
Fly.io doesn't set a maximum of 8 hours of alive time on your instance. Also, MicroVMs can't be exposed directly to the web. Your code running in them can only be executed via API calls with attached auth tokens - so if you wanted to host a public facing API or website with them you'd need to implement your own additional layer in front. Something I appreciate about Fly (disclaimer: they support my work) is that the…
Fly.io's Sprites [1] do offer public web access as an option. They also have dynamic pricing.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#58> MicroVMs support up to 8 hours of total runtime Does this mean you effectively can't use them as long-lived developer environments? It sounds like even if you suspend them, this is the hard limit on the total time it can run.
lambdas are ephemeral on compute, but couldn't you connect up EFS for your long lived data? then when you launch the next one, its like you are still there?
EFS is extremely slow for many workloads. We tried it for builds and various other common use cases for coding agents and the performance just isn't there. I'm guessing lots of small random reads/writes just isn't going to ever work well.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#59It's about time AWS got into the agent sandbox game. The startups in this space right now don't provide much value on top of the cloud providers they're wrapping. They don't tend to be run by experienced infra people either so they seem very vibecoded, insecure, janky, etc. They're also significantly overpriced because they're marking up already expensive providers. Something surprising from my own experience is that…
AWS AgentCore runtime has been around for about a year: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguid... (spoiler, it's the same underlying technology as the Lambda MicroVMs).
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#60> Containers launch in seconds, yet their shared-kernel architecture requires significant custom hardening to safely contain untrusted code That's literally why they made Fargate. It's managed firecracker VMs with containers. They invented firecracker for this purpose. This new product is competing with Fargate, but they don't mention Fargate at all in the announcement. > you create a MicroVM Image by supplying a Doc…
Fargate does not use Firecracker, it is simply ec2 instances.
Source?
https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir... says
> Battle-Tested – Firecracker has been battled-tested and is already powering multiple high-volume AWS services including AWS Lambda and AWS Fargate.