Sub-millisecond VM sandboxes using CoW memory forking
Details
- External ID
- 47412569
- Source
- HN
- Company
- —
- Product
- Sub-millisecond VM sandboxes using CoW memory forking
- Website domain
- github.com
- Launched
- March 17, 2026
- Cohort
- —
- Upvotes
- 311
- Upvotes percentile
- 0.9790897908979089
- Tags
- —
- Fetched at
- Sept. 7, 2026, 9:26 p.m.
- Updated at
- Sept. 7, 2026, 9:26 p.m.
Description
I wanted to see how fast an isolated code sandbox could start if I never had to boot a fresh VM.So instead of launching a new microVM per execution, I boot Firecracker once with Python and numpy already loaded, then snapshot the full VM state. Every execution after that creates a new KVM VM backed by a `MAP_PRIVATE` mapping of the snapshot memory, so Linux gives me copy-on-write pages automatically.That means each sandbox starts from an already-running Python process inside a real VM, runs the code, and exits.These are real KVM VMs, not containers: separate guest kernel, separate guest memory, separate page tables. When a VM writes to memory, it gets a private copy of that page.The hard part was not CoW itself. The hard part was resuming the snapshotted VM correctly.Rust, Apache 2.0.
Enrichment
- Theme
- lightweight and on-device AI runtimes
- Vertical
- Horizontal
- Function
- Hardware & robotics
- Audience
- Developer
- AI stance
- Not AI
- Project type
- Commercial product
- Normalized one-liner
- sub-millisecond vm sandboxes using cow memory
- Manually corrected
- False
Could you build this?
No Directly manipulating Firecracker snapshots and KVM memory backings for sub-millisecond VM forks involves low-level Linux kernel and hypervisor systems programming.
What it would actually take: Achieving sub-millisecond execution times requires intercepting KVM ioctls, managing guest physical memory via shared memory regions (shm/mmap) with CoW, and state snapshotting. A builder must possess specialized Linux virtualization and systems engineering knowledge, writing low-level Rust/C code to manipulate Firecracker microVM state directly without OS-level process spinup overhead.
Discussion
20 comments analyzed.
Competitors mentioned: WSL (Windows Subsystem for Linux), CodeSandbox, exe.dev
Concerns raised: No networking inside forks limits usability, TTY staleness and renewal issues after freeze, Storage accumulation from version drift in base images, NVMe becomes bottleneck with file system approach, Fault storm problem for longer-running sandboxes
Feature requests: Add virtio-net to forks for networking support, Support for MSVC/CMake/Ninja/Incredibuild toolchains, Run minikube inside for ephemeral cluster testing, Reflink support for tmpfs in Linux kernel
Competitors
Other products that read as similar to this one — 188 launches clear the similarity bar, closest 8 shown.
Attention rank: #4 of 189 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 136 days after the earliest competitor.
- Clone, a small Rust VMM, forks VMs in under 20ms via CoW · hn · 2026-04-19 · 11 upvotes · similarity 0.58
- machine0 · hn · 2026-06-15 · 96 upvotes · similarity 0.52
- RiceVM · hn · 2026-04-02 · 7 upvotes · similarity 0.51
- Zeroboot · hn · 2026-03-17 · 20 upvotes · similarity 0.51
- Vpod · hn · 2026-06-17 · 12 upvotes · similarity 0.50
- Tarit · hn · 2026-07-08 · 6 upvotes · similarity 0.50
- Superserve · hn · 2026-07-21 · 9 upvotes · similarity 0.48
- Forkrun · hn · 2026-03-27 · 151 upvotes · similarity 0.48
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a hardware & robotics tool for Fintech yet.