An interesting alternative: https://shellbox.dev - manage linux vms via ssh, pay only for what you use. It is much cheaper, no subscription is needed, supports nested virt, docker, custom images, duplication of boxes, gives an ipv6, auto-stop on optional auto stop on disconnect, wakeup on web endpoint hit, email endpoint, exposed ipv6, and more. Parked boxes are just $0.5/month. Create small or large boxes up to 16vcpu with 32gb ram and 400gb hdd
MicroVMs: Run isolated sandboxes with full lifecycle control
131–140 of 222 posts
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#132Earlier quoted context omitted.
Source? https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir... says > Battle-Tested – Firecracker has been battled-tested and is already powering multiple high-volume AWS services including AWS Lambda and AWS Fargate.
Counterpoint: https://justingarrison.com/blog/2024-02-08-fargate-is-not-fi... And also, you’ll notice that Fargate takes minutes to launch while Lambda takes a second or less. You’re waiting on AWS to launch a EC2 with your config and pull your containers into it. (that article matches things I heard from Amazon when I asked why my stuff is slow)
I can't tell you why Fargate is so slow, but the reason Lambda containers are so fast is because it doesn't actually load the image. It loads a manifest of the layers and the files in each, and then each file is loaded on-demand from a multi-tier cache. 90% of the image is never loaded, and 90% of the remainder is served from local cache. It's a pretty cool architecture.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#133For those looking to run agents: the short lifecycle of the typical “sandbox” seems surprisingly limiting to me. I have no actual workflow where I want one of these products. Sometimes a VM can live for 30 minutes, but it also might need to live for a month, and I don’t know beforehand. This is why I have been avoiding the word sandbox for exe.dev. I don’t think developers agents need something “sandbox” shaped.
Checkout https://shellbox.dev for exactly thisnusecase: boxes can be stopped, they are snapshotted to disk then cost just $0.5/month. They wakeup with the same state (memory and processes too) on ssh connections, or web endpoint activity, or just just a cron schedule. When you dont need the box... Just delete it and stop paying. No subscription, managed via ssh
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#134Earlier quoted context omitted.
Any reason why you wouldn't use gVisor's bwrap interface yet? We're working on it precisely to make DIY sandboxing on Linux as easy as possible in order to get Linux-sandboxing-at-home to mature beyond the current syscall-filter-and-namespaces duct tape stage, so I'm curious to know what you'd like to see.
It just didn't seem fully baked yet, the 'do' subcommand works fine while the 'bwrap' alias has this problem: `bash: cannot set terminal process group (1): Not a tty`. When executing 'bash -li'. Also the EROFS feature of 'do' should probably be included in 'bwrap', it can be useful. Include overlay options. Also some things you can do to make gvisor better are Wayland passthrough, vulkan support (or virtio native con…
Thanks. We're working on rootless network setup to make `runsc do --rootless` work with networking enabled when `passt` is installed right now. See issue #13337 (yes that's a cool issue number) which should unblock this.
The tty issue is known, should be fixed soon too, though contributions welcome as it sounds like it should be simple fix and we love more contributions :)
FWIW, X11 apps work well, I have a personal hacky project in which I've been running Librewolf in gVisor, with the window being reflected as a native Wayland window. It uses `Xvfb -fbdir` aimed at a bound tmpfs mount to get a shared memory region containing the window's pixel data which can be read directly from out of the sandbox, has Pulseaudio audio passthrough, and a socket server passing through mouse/keyboard events to make the window interactive. Works smoothly even for YouTube playback, and I successfully played a game of Unreal Tournament 2004 at 24fps in it, with no noticeable mouse/keyboard latency :) We're basically making baby steps to get there less hackily.
Thanks for the feedback!
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#135Earlier quoted context omitted.
It just didn't seem fully baked yet, the 'do' subcommand works fine while the 'bwrap' alias has this problem: `bash: cannot set terminal process group (1): Not a tty`. When executing 'bash -li'. Also the EROFS feature of 'do' should probably be included in 'bwrap', it can be useful. Include overlay options. Also some things you can do to make gvisor better are Wayland passthrough, vulkan support (or virtio native con…
Thanks. We're working on rootless network setup to make `runsc do --rootless` work with networking enabled when `passt` is installed right now. See issue #13337 (yes that's a cool issue number) which should unblock this. The tty issue is known, should be fixed soon too, though contributions welcome as it sounds like it should be simple fix and we love more contributions :) FWIW, X11 apps work well, I have a personal…
That's good to hear! Hopefully the passt approach you are pursuing will include the ability to use an existing passt socket and not just launch one for you.
Wayland is tricky because there are memory buffers being shared between the compositor and the client. crosvm (also by google) adopted 2 custom solutions to it of which one got merged into mainline.
Achieving audio passthrough is trivial as it's just a unix socket. `-host-uds=all`
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#136> MicroVMs support up to 8 hours of total runtime Does this mean you effectively can't use them as long-lived developer environments? It sounds like even if you suspend them, this is the hard limit on the total time it can run.
Firecracker doesn't reclaim RAM well, so they put this limit in to make sure you don't suffer from the eventual memory bloat problems.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#137Earlier quoted context omitted.
Fly.io's Sprites [1] do offer public web access as an option. They also have dynamic pricing. https://sprites.dev
To a first approximation everything in this space has dynamic pricing. If it's not priced dynamically, you're presumably paying a premium either on a commit or in gym pricing.
I don't know what the right term is, but maybe "deterministic" pricing (this is not the right term, but maybe closer). That is, I'm not going to know how much a sprite cost until I see the bill (or look up the live usage report), whereas if I spin up a Fly Machine, I know exactly how much I'm going to pay per unit of time.
(Both make sense for their respective use cases.)
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#138Earlier quoted context omitted.
Fargate does not use Firecracker, it is simply ec2 instances.
Source? https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir... says > Battle-Tested – Firecracker has been battled-tested and is already powering multiple high-volume AWS services including AWS Lambda and AWS Fargate.
It was true a long time ago for some particular cases, but is not true since quite some years now.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#139I feel like most of these are solely used for RL environments and training, when else are you doing enough rollouts with LLM code writing and execution. Maybe there are some online applications of this but seems like Modal, Daytona, etc. already have this + a much richer feature set tailored to the aforementioned. Wonder if AWS play is going to be swallow one of those whole.
Re: MicroVMs: Run isolated sandboxes with full lifecycle control
#140We have this page which compares a whole bunch of sandbox providers in different categories https://engine.build/lab/agent-sandboxes Will add MicroVMs there today (and any others that are missing if you let me know!)
Do you mind adding https://isorun.ai ? We just launched last week. Founder here (Staff SRE with 20 years in Linux, fastest and cheapest SaaS agentic runtime running on heavily modified Firecracker)
Sure thing I'll add it!