[{"data":1,"prerenderedAt":413},["ShallowReactive",2],{"project-47412569":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":44,"post_text":46,"what":47,"said":92,"maker_in_thread":183,"shape":193,"grid":197,"attempts":370,"same_week":375,"maker_shows":34,"maker_hidden":405,"reader_version":406,"card":407},"47412569","zeroboot","Sub-millisecond VM sandboxes using CoW memory forking","title","Show HN: Sub-millisecond VM sandboxes using CoW memory forking","https:\u002F\u002Fgithub.com\u002Fadammiribyan\u002Fzeroboot","github.com","adammiribyan",1773755024,2026,311,72,142,4366,4,"legend","dev_tools","sandboxed code execution","library",[24,25,26,27,28],"sandbox","firecracker","copy-on-write","microvm","fork","curious",-0.013,{"positive":32,"neutral":33,"mixed":34,"critical":32},6,19,1,32,{"execution":37,"privacy":39,"idea":40,"performance":42,"pricing":43},{"positive":38,"critical":18},0,{"positive":38,"critical":34},{"positive":41,"critical":38},5,{"positive":38,"critical":34},{"positive":38,"critical":38},[34,45,34,38,38,38,45,38,38,38,38,38,45,45,41,41,41,38,45,45,45,45,34,34,38,45,45,45,34,38,45,45,45,45,34,41,41,38,38,41],3,null,{"problem":48,"audience":57,"pricing":68,"motivation":46,"time_to_build":46,"stack":75,"openness":89,"stage":90,"team_size":91},{"value":49,"source":50,"evidence":51},"Starting isolated VM sandboxes for running code takes too long per run.","inferred",[52,54],{"id":53},"post",{"id":55,"by":11,"text":56},"47422036","Agreed, cross-node is the hard next step. For now single-node density gets you surprisingly far. 1000 concurrent sandboxes on one $50 box. When we need multi-node, userfaultfd…",{"value":58,"source":50,"evidence":59},"Developers and teams running untrusted or agent-generated code in sandboxes.",[60,64],{"id":61,"by":62,"text":63},"47424649","BornaP","Really impressive work. Sub-millisecond cold starts via CoW forking is a pretty clever approach. The tricky part we keep running into with agent sandboxes is that code execution…",{"id":65,"by":66,"text":67},"47422572","injidup","It's so frustrating seeing all this sandbox tooling pop up for linux but windows is soooooo far behind. I mean Windows Sandbox (…",{"value":69,"source":70,"evidence":71},"Engine is open source; a managed service is planned.","maker",[72],{"id":73,"by":11,"text":74},"47436662","Both. The engine is open source. You can self-host it on any Linux box with KVM. There's also a live API you can hit right now (curl example in the README). Building the managed…",[76,85],{"value":77,"source":70,"evidence":78},"Firecracker",[79,82],{"id":80,"by":11,"text":81},"47422007","Good callout. We seed entropy before snapshot to unblock getrandom(), but forks still share CSPRNG state. The proper fix per Firecracker’s docs is RNDADDENTROPY + RNDRESEEDCRNG…",{"id":83,"by":11,"text":84},"47422381","1 vCPU per fork currently. Multi-vCPU is doable (per-vCPU state restore in a loop) but would multiply fork time. On Firecracker version: tested with v1.12, but the vmstate parser…",{"value":86,"source":70,"evidence":87},"KVM",[88],{"id":73,"by":11,"text":74},"open_source","beta","unknown",{"praise":93,"objections":107,"requests":130,"questions":149,"alternatives":164},[94],{"value":95,"source":96,"evidence":97},"Clever fork-like approach to fast VM cold starts.","commenter",[98,99,103],{"id":61,"by":62,"text":63},{"id":100,"by":101,"text":102},"47427004","quickrefio","Feels like fork() but for VMs—very cool.",{"id":104,"by":105,"text":106},"47427307","theredsix","super clever and awesome!",[108,116,123],{"value":109,"source":96,"evidence":110},"Forks share RNG state, a security risk until reseeding is fixed.",[111,115],{"id":112,"by":113,"text":114},"47420878","cperciva","Don't forget about entropy! You've just created two identical copies of all of your random number generators, which could be very very bad for security. The firecracker team…",{"id":80,"by":11,"text":81},{"value":117,"source":96,"evidence":118},"Forks have no networking.",[119],{"id":120,"by":121,"text":122},"47448770","wang_cong","No networking inside forks? This is not usable.",{"value":124,"source":96,"evidence":125},"Base image updates are hard with many CoW forks.",[126],{"id":127,"by":128,"text":129},"47423493","hrmtst93837","The thing people tend to gloss over is how CoW shines until you need to update the base image, then you start playing whack-a-mole with stale memory and hotpatching. Snapshots…",[131,135,142],{"value":132,"source":96,"evidence":133},"Add networking to forks.",[134],{"id":120,"by":121,"text":122},{"value":136,"source":96,"evidence":137},"Offer a self-hosted or open-source version.",[138],{"id":139,"by":140,"text":141},"47430244","huksley","Any plans to offer self-hosted \u002F open-source version?",{"value":143,"source":96,"evidence":144},"Support multi-vCPU forks.",[145],{"id":146,"by":147,"text":148},"47420508","vmg12","Does it only work with that specific version of firecracker and only with vms with 1 vcpu? More than the sub ms startup time the 258kb of ram per VM is huge.",[150,157],{"value":151,"source":96,"evidence":152},"Can it run inside another sandbox or nested VM?",[153],{"id":154,"by":155,"text":156},"47420340","handfuloflight","Can you run this in another sandbox? Not sure why you'd want to... but can you?",{"value":158,"source":96,"evidence":159},"How does it behave under load with many concurrent forks?",[160],{"id":161,"by":162,"text":163},"47422034","Jeffrin-dev","The CoW forking approach is clever but I'm curious about the memory isolation story under load. When you have 1000 concurrent forks all writing to pages, you're triggering a lot…",[165,172,179],{"value":166,"source":96,"evidence":167},"CodeSandbox VM cloning",[168],{"id":169,"by":170,"text":171},"47420820","indigodaddy","Your write-up made me think of: https:\u002F\u002Fcodesandbox.io\u002Fblog\u002Fhow-we-clone-a-running-vm-in-2-seconds Are there parallels?",{"value":173,"source":96,"evidence":174},"sprites.dev",[175],{"id":176,"by":177,"text":178},"47421087","latortuga","Similar to sprites.dev?",{"value":180,"source":96,"evidence":181},"Windows Sandbox",[182],{"id":65,"by":66,"text":67},{"comments":184,"answered":45,"key":185},8,[186,187,190],{"id":80,"text":81},{"id":188,"text":189},"47422063","Exactly —- they skip the OS, we make it free to clone.",{"id":191,"text":192},"47436717","Glad to see the approach validated at scale! I hadn't seen your blog posts until they were linked here, going to dig into the userfaultfd path. Would love to chat if you're open…",{"commenters":194,"max_depth":32,"maker_replies":184,"first_comment_mins":195,"lifespan_hours":196},45,661,321,[198,200,204,207,209,213,216,219,221,223,227,229,232,235,238,241,243,246,249,252,256,259,262,265,268,271,274,275,277,281,283,284,287,289,292,294,296,300,304,308,310,313,316,320,324,326,328,331,334,337,339,343,345,347,350,352,354,356,359,362,365,368],[112,38,34,199,113,38],"project\u002Fcritical\u002Fexecution",[201,38,45,202,203,38],"47421586","project\u002Fneutral\u002Fexecution","Retr0id",[205,38,45,202,206,38],"47421715","hinkley",[208,38,34,199,113,38],"47421957",[210,38,38,211,212,38],"47424056","other\u002Fneutral\u002Fnone","Intermernet",[214,38,38,211,215,38],"47425562","aa-jv",[217,38,38,211,218,38],"47429055","treyd",[220,38,38,211,215,38],"47451943",[80,38,38,222,11,34],"maker\u002Fneutral\u002Fprivacy",[224,38,45,225,226,38],"47422124","project\u002Fneutral\u002Fprivacy","mkj",[65,34,38,228,66,38],"other\u002Fcritical\u002Fnone",[230,34,38,228,231,38],"47422811","CTDOCodebases",[233,34,38,211,234,38],"47423563","benterix",[236,34,38,211,237,38],"47423680","lionkor",[239,34,38,211,240,38],"47423887","wongarsu",[242,34,38,211,212,38],"47424079",[244,34,38,211,245,38],"47423786","ddtaylor",[247,34,38,248,62,38],"47424598","other\u002Fpositive\u002Fnone",[250,34,45,251,66,38],"47426254","project\u002Fneutral\u002Fnone",[253,34,45,254,255,38],"47430429","maker\u002Fneutral\u002Fnone","bperak",[257,34,45,254,258,38],"47424630","ivan_burazin",[260,34,38,211,261,38],"47437845","RyleHisk",[61,263,41,264,62,38],2,"project\u002Fpositive\u002Fidea",[266,45,41,264,267,38],"47420684","crawshaw",[269,45,38,270,170,38],"47420827","commenter\u002Fneutral\u002Fnone",[272,45,41,264,273,38],"47421899","edunteman",[188,45,38,264,11,34],[127,45,45,276,128,38],"project\u002Fmixed\u002Fidea",[278,45,38,279,280,38],"47425895","commenter\u002Fneutral\u002Fexecution","smj-edison",[282,45,45,202,267,38],"47426665",[169,18,38,211,170,38],[285,18,45,202,286,38],"47426413","CompuIves",[191,18,38,288,11,34],"maker\u002Fpositive\u002Fnone",[290,18,45,202,291,38],"47580564","Liskni_si",[146,41,34,293,147,38],"project\u002Fcritical\u002Fperformance",[83,41,38,295,11,34],"project\u002Fneutral\u002Fperformance",[297,32,34,298,299,38],"47420810","project\u002Fcritical\u002Fprivacy","buckle8017",[301,302,38,270,303,38],"47423147",7,"deivid",[305,184,45,306,307,38],"47426329","project\u002Fneutral\u002Fpricing","aftbit",[73,184,38,309,11,34],"maker\u002Fneutral\u002Fpricing",[311,312,45,202,170,38],"47420839",9,[314,312,45,202,315,38],"47422685","dizhn",[317,318,45,319,215,38],"47425541",10,"project\u002Fneutral\u002Fidea",[321,322,34,199,323,38],"47420711",11,"diptanu",[325,322,38,211,170,38],"47420851",[55,322,38,327,11,34],"maker\u002Fpositive\u002Fperformance",[329,322,45,295,330,38],"47425259","shayonj",[332,322,38,333,11,34],"47436677","maker\u002Fneutral\u002Fperformance",[335,322,45,202,336,38],"47423710","Rygian",[176,338,38,211,177,38],12,[340,341,45,251,342,38],"47426557",13,"polskibus",[139,344,45,306,140,38],14,[120,346,34,199,121,38],15,[348,346,38,349,11,34],"47452898","maker\u002Fneutral\u002Fexecution",[100,351,41,264,101,38],16,[104,353,41,264,105,38],17,[154,355,45,251,155,38],18,[357,355,38,270,358,38],"47420433","wmf",[360,355,38,270,361,38],"47420523","Teknoman117",[363,33,38,211,364,38],"47420521","jauntywundrkind",[366,33,41,288,367,38],"47422812","tomhow",[161,369,45,295,162,38],20,[371,372],{"id":4,"t":12,"points":14,"comments":15},{"id":373,"t":374,"points":369,"comments":34},"47412812",1773756060,[376,381,386,391,395,400],{"id":377,"name":378,"points":379,"category":380},"47344548","s@",414,"languages",{"id":382,"name":383,"points":384,"category":385},"47378781","Hacker News archive (open-index)",408,"data",{"id":387,"name":388,"points":389,"category":390},"47427299","SVG backgrounds",403,"creative",{"id":392,"name":393,"points":394,"category":20},"47400868","Godogen",337,{"id":396,"name":397,"points":398,"category":399},"47428650","Will my flight have Starlink?",276,"consumer_social",{"id":401,"name":402,"points":403,"category":404},"47431671","llm-circuit-finder",265,"ai",false,"v2",{"id":408,"name":5,"line":6,"ai":405,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":409,"top":18,"kw":410,"maker":11,"domain":10,"tier":19,"attempts":263,"strip":411,"url":9,"mix":412,"praise":95,"objection":109,"sub":21},47412569,-0.01,[24,25,26,27,28],"1310003000003355503333110333103333155005",[32,33,34,32],1794036696457]