kvmserver

It seems to work for my https://github.com/libriscv/kvmserver tests at least.

There's also JCO for creating JS based WebAssembly components. It's based on StarlingMonkey which I believe is slightly faster than QuickJS under web assembly. https://github.com/bytecodealliance/jco Benchmark numbers for request isolated JS hello world / React page rendering: JCO/wasmtime: 314µs / 13ms Bun process forking: 1.7ms / 8.2ms v8 isolate from snapshot: 0.7ms / 22ms TinyKVM: 52µs / 708µs Native with reuse 14µs / 640µs Numbers taken from our upcoming TinyKVM paper. Benchmark setup code for JCO/wasmtime is here: https://github.com/libriscv/kvmserver/tree/main/examples/was... (I suspect even if we are able to get TinyKVM into a state you'd feel comfortable with in the future it would still be an awkward fit for Datasette since nested virtualisation is not exposed on AWS EC2.)

As I understand it separate isolates in a single process are inherently less secure than separate processes (e.g. Chrome's site isolation) which is again less secure than virtualization based solutions. As a TinyKVM / KVM Server contributor I'm obviously hopeful our approach will work out, but we still have some way to go to get to a level of polish that makes it easy to get going with and have the confidence of production level experience. TinyKVM has the advantage of a much smaller surface area to secure as a KVM based solution and the ability to offer fast per-request isolation as we can reset the VM state a couple of orders of magnitude faster than v8 can create a new isolate from a snapshot. https://github.com/libriscv/kvmserver

I doubt how much its good but I really like playing with kvmserver by fwsgonzo who is a coder that I compare in the likes with bellard. https://github.com/libriscv/kvmserver

TinyKVM [1] has similarities to the gVisor approach but runs at the KVM level instead, proxying a limited set of system calls through to the host. EDIT: It seems that gVisor has a KVM mode too. https://gvisor.dev/docs/architecture_guide/platforms/#kvm I've been working on KVMServer [2] recently which uses TinyKVM to run existing Linux server applications by intercepting epoll calls. While there is a small overhead to crossing the KVM boundary to handle sys calls we get the ability to quickly reset the state of the guest. This means we can provide per-request isolation with an order of magnitude less overhead than alternative approaches like forking a process or even spinning up a v8 isolate. [1] Previous discussion: https://news.ycombinator.com/item?id=43358980 [2] https://github.com/libriscv/kvmserver