zeroboot
Dev tools
sandboxed code execution
SHOW HN2026
How HN took it
6 positive, 19 neutral or asking, 1 mixed, 6 critical, out of 32 comments about the project. Thread score -0.01.
Idea: 5 for, 0 againstExecution: 0 for, 4 againstPrivacy: 0 for, 1 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever fork-like approach to fast VM cold starts.
From 3 comments
Really impressive work. Sub-millisecond cold starts via CoW forking is a pretty clever approach. The tricky part we keep running into with agent sandboxes is that code execution…
BornaP on HNFeels like fork() but for VMs—very cool.
quickrefio on HNsuper clever and awesome!
theredsix on HN
Objections
Forks share RNG state, a security risk until reseeding is fixed.
From 2 comments
Don't forget about entropy! You've just created two identical copies of all of your random number generators, which could be very very bad for security. The firecracker team…
cperciva on HNGood callout. We seed entropy before snapshot to unblock getrandom(), but forks still share CSPRNG state. The proper fix per Firecracker’s docs is RNDADDENTROPY + RNDRESEEDCRNG…
adammiribyan on HN
Forks have no networking.
From 1 comment
No networking inside forks? This is not usable.
wang_cong on HN
Base image updates are hard with many CoW forks.
From 1 comment
The thing people tend to gloss over is how CoW shines until you need to update the base image, then you start playing whack-a-mole with stale memory and hotpatching. Snapshots…
hrmtst93837 on HN
Requests
Add networking to forks.
From 1 comment
No networking inside forks? This is not usable.
wang_cong on HN
Offer a self-hosted or open-source version.
From 1 comment
Any plans to offer self-hosted / open-source version?
huksley on HN
Support multi-vCPU forks.
From 1 comment
Does it only work with that specific version of firecracker and only with vms with 1 vcpu? More than the sub ms startup time the 258kb of ram per VM is huge.
vmg12 on HN
Questions
Can it run inside another sandbox or nested VM?
From 1 comment
Can you run this in another sandbox? Not sure why you'd want to... but can you?
handfuloflight on HN
How does it behave under load with many concurrent forks?
From 1 comment
The CoW forking approach is clever but I'm curious about the memory isolation story under load. When you have 1000 concurrent forks all writing to pages, you're triggering a lot…
Jeffrin-dev on HN
Alternatives named
CodeSandbox VM cloning
From 1 comment
Your write-up made me think of: https://codesandbox.io/blog/how-we-clone-a-running-vm-in-2-seconds Are there parallels?
indigodaddy on HN
sprites.dev
From 1 comment
Similar to sprites.dev?
latortuga on HN
Windows Sandbox
From 1 comment
It's so frustrating seeing all this sandbox tooling pop up for linux but windows is soooooo far behind. I mean Windows Sandbox (…
injidup on HN