firecracker

From the Firecracker README: https://github.com/firecracker-microvm/firecracker "Firecracker was developed at Amazon Web Services to accelerate the speed and efficiency of services like AWS Lambda and AWS Fargate."

Firecracker has existing solutions to this, which I assume they're using: https://github.com/firecracker-microvm/firecracker/blob/main...

That's the direction container runtimes are trending Amazon has been doing it with Firecracker for a while and Kata containers is another popular one https://github.com/firecracker-microvm/firecracker https://github.com/kata-containers/kata-containers

Thanks for sharing! I'm not sure your table under Why Clone is quite correct. 10x 512MB idle VMs should not take 5GB on Firecracker if they are started from snapshots since the 512MB memory file is mmap'ed with MAP_PRIVATE so is copy on write. Firecracker has diff snapshots: https://github.com/firecracker-microvm/firecracker/blob/main...

firecracker was designed for AWS Lambda and designed to be maintained by multiple AWS teams. You're likely to experience operational + setup hiccups to use it in production. Just look at their setup docs: Setup: https://github.com/firecracker-microvm/firecracker/blob/main... https://github.com/firecracker-microvm/firecracker/blob/main...

Self hosting can be doable for constant small/medium size workloads You can handroll a lot with: https://github.com/nestybox/sysbox?tab=readme-ov-file https://gvisor.dev https://github.com/containers/bubblewrap?tab=readme-ov-file For hardware virtualized machines it much harder but you can do it via: https://github.com/firecracker-microvm/firecracker/ https://github.com/cloud-hypervisor/cloud-hypervisor Freestyle/other providers will likely provide better debugging experience but thats something you can probably get past for a lot of workloads. The time when you/anyone should think about Freestyle/anyone is when the load spikes/the need to create hundreds of VMs in short spikes shows up, or when you're looking for some of the more complex feature sets any given provider has built out (forks, GPUs, network boundaries, etc). I also highly r

It looks like firecracker already supports ACPI vmgenid, which will trigger Linux random to reseed? https://github.com/firecracker-microvm/firecracker/blob/main... https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... So that just (!) leaves userspace PRNGs.

Good callout. We seed entropy before snapshot to unblock getrandom(), but forks still share CSPRNG state. The proper fix per Firecracker’s docs is RNDADDENTROPY + RNDRESEEDCRNG after each fork, plus reseeding userspace PRNGs like numpy separately. On the roadmap. https://github.com/firecracker-microvm/firecracker/blob/main...

Huh. You're converting FUSE requests into your own custom protocol (with copy-pasted protocol definition) over vsock. Interesting. Not sure I'd trust it with my data[0], but interesting. I don't think the current filepath.Join in realfs.go protects the host against a malicious guest, at all. I'm assuming this is configured as Guest --FUSE--> guest-fused (inside VM) --VSOCK--> realfs. (The Firecracker people have explicitly refused to have virtio-fs, to keep it minimal: https://github.com/firecracker-microvm/firecracker/pull/1351...) https://github.com/jingkaihe/matchlock/blob/123a4df680fb8cc0... https://github.com/jingkaihe/matchlock/blob/123a4df680fb8cc0... https://github.com/jingkaihe/matchlock/blob/123a4df680fb8cc0... [0]: Well, I already know I won't trust hanwen/go-fuse with my data, so that part is a bit moot.