Live data from Hacker News

Microsandbox: Virtual Machines that feel and perform like containers

github.com

21–30 of 195 posts

Re: Microsandbox: Virtual Machines that feel and perform like containers

#21
post #12

Why not some of the existing microvm efforts? Cloud Hypervisor and Firecracker both have an excellent reputation for ultra lightweight VM's. Both are usable in the very popular Kata Containers project (as well as other upstart VM's Dragonball, & StratoVirt). In us by for example the CNCF Confidential Containers https://github.com/kata-containers/kata-containers/blob/main... https://confidentialcontainers.org/ There's…

If we get enough of these sandboxes, maybe we will finally get one that's easy for me to run on my own machines.

That's the plan lol. There is too much friction setting up existing solutions.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#22

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

Looks great! This might be extremely useful for a distributed/decentralized software testing network I'm building (called Valet Network)...

Question: How does networking work? Can I restrict/limit microvms so that they can only access public IP addresses? (or in other words... making sure the microvms can't access any local network IP addresses)

Re: Microsandbox: Virtual Machines that feel and perform like containers

#23

Tangential question: why does it normally take so long to start traditional VMs in the first place? At least on Windows, if you start a traditional VM, it takes several seconds for it to start running anything . Edit: when I say anything , I'm not talking user programs. I mean as in, before even the first instruction of the firmware -- before even the virtual disk file is zeroed out, in cases where it needs to be. Yo…

I mean it is basically booting a computer from scratch, kind of makes sense. You have to allocate memory, start virtual CPUs, initialize devices, run BIOS/UEFI checks, perform hardware enumeration, all that jazz while emulating all of it, which tends to be slower than "real" implementations. I guess there is a bunch of processes for security as well, like wiping like zeroing pages and similar things that takes additional time.

If I let a VM use most of my hardware, it takes a few seconds from start to login prompt, which is the same time it takes for my Arch desktop to boot from pressing the button to seeing the login prompt.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#24
post #12

Earlier quoted context omitted.

If we get enough of these sandboxes, maybe we will finally get one that's easy for me to run on my own machines.

Which platforms do you use?

macOS on my laptop, anything that runs in a container for when I deploy things.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#25

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

What's the story for macOS support?

Re: Microsandbox: Virtual Machines that feel and perform like containers

#26
post #25

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

What's the story for macOS support?

[deleted]

Re: Microsandbox: Virtual Machines that feel and perform like containers

#27

Tangential question: why does it normally take so long to start traditional VMs in the first place? At least on Windows, if you start a traditional VM, it takes several seconds for it to start running anything . Edit: when I say anything , I'm not talking user programs. I mean as in, before even the first instruction of the firmware -- before even the virtual disk file is zeroed out, in cases where it needs to be. Yo…

You can optimize a lot to start a Linux kernel in under a second, but if you're using a standard kernel, there are all manners of timeouts and poll attempts that make the kernel waste time booting. There's also a non-trivial amount of time the VM spends in the UEFI/CSM system preparing the virtual hardware and initializing the system environment for your bootloader. I'm pretty sure WSL2 uses a special kernel to avoid the unnecessary overhead.

You also need to start OS services, configure filesystems, prepare caches, configure networking, and so on. If you're not booting UKIs or similar tools, you'll also be loading a bootloader, then loading an initramfs into memory, then loading the main OS and starting the services you actually need, with eachsstep requiring certain daemons and hardware probes to work correctly.

There are tools to fix this problem. Amazon's Firecracker can start a Linux VM in a time similar to that of a container (milliseconds) by basically storing the initialized state of the VM and loading that into memory instead of actually performing a real boot. https://firecracker-microvm.github.io/

On Windows, I think it depends on the hypervisor you use. Hyper V has a pretty slow UEFI environment, its hard disk access always seems rather slow to me, and most Linux distro don't seem to package dedicated minimal kernels for it.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#28
post #25

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

What's the story for macOS support?

It uses libkrun which uses Hypervisor.framework on macOS.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#29

Earlier quoted context omitted.

Only did a quick skim of the readme, but a few questions which I would like some elaboration. How is it so fast? Is it making any trade offs vs a traditional VM? Is there potential the VM isolation is compromised? Can I run a GUI inside of it? Do you think of this as a new Vagrant? How do I get data in/out?

> How is it so fast? Is it making any trade offs vs a traditional VM? Is there potential the VM isolation is compromised? It is a lighweight VM and uses the same technology as Firecracker > Can I run a GUI inside of it? It is planned but not yet implemented. But it is absolutely possible. > Do you think of this as a new Vagrant? I would consider Docker for VMs instead. In a similar way, it focuses on dev ops type use…

> I would consider Docker for VMs instead.

Native Containers would probably solve here, too.

From https://news.ycombinator.com/item?id=43553198 :

>>> ostree native containers are bootable host images that can also be built and signed with a SLSA provenance attestation; https://coreos.github.io/rpm-ostree/container/

And also from that thread:

> How should a microkernel run (WASI) WASM runtimes?

What is the most minimal microvm for WASM / WASI, and what are the advantages to running WASM workloads with firecracker or microsandbox?

Re: Microsandbox: Virtual Machines that feel and perform like containers

#30
post #23

Tangential question: why does it normally take so long to start traditional VMs in the first place? At least on Windows, if you start a traditional VM, it takes several seconds for it to start running anything . Edit: when I say anything , I'm not talking user programs. I mean as in, before even the first instruction of the firmware -- before even the virtual disk file is zeroed out, in cases where it needs to be. Yo…

I mean it is basically booting a computer from scratch, kind of makes sense. You have to allocate memory, start virtual CPUs, initialize devices, run BIOS/UEFI checks, perform hardware enumeration, all that jazz while emulating all of it, which tends to be slower than "real" implementations. I guess there is a bunch of processes for security as well, like wiping like zeroing pages and similar things that takes additi…

> You have to allocate memory, start virtual CPUs, initialize devices, run BIOS/UEFI checks, perform hardware enumeration, all that jazz while emulating all of it, which tends to be slower than "real" implementations.

That's not what I'm asking.

I'm saying it takes a long time for it to even execute a single instruction, in the BIOS itself. Even for the window to pop up, before you can even pause the VM (because it hasn't even started yet). What you're describing comes after all that, which I already understand and am not asking about.

Post reply on HN