Sub-millisecond VM sandboxes using CoW memory forking
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
I wanted to see how fast an isolated code sandbox could start if I never had to boot a fresh VM.So instead of launching a new microVM per execution, I boot Firecracker once with Python and numpy already loaded, then snapshot the full VM state. Every execution after that creates a new KVM VM backed by a `MAP_PRIVATE` mapping of the snapshot memory, so Linux gives me copy-on-write pages automatically.That means each sandbox starts from an already-running Python process inside a real VM, runs the code, and exits.These are real KVM VMs, not containers: separate guest kernel, separate guest memory, separate page tables. When a VM writes to memory, it gets a private copy of that page.The hard part was not CoW itself. The hard part was resuming the snapshotted VM correctly.Rust, Apache 2.0.
HN · launched Mar 17, 2026 · 311 upvotes (top 2%) · 1 view
Niche: code execution sandboxes · 37 launches, 1 in the last 7 days · Explore this niche →
Category and tags
- Horizontal
- Dev tools
- Developer
- Not AI
- Commercial product
Visit website ↗ Source listing ↗
More like this: all 37 launches in code execution sandboxes →
Could you build this?
No Directly manipulating Firecracker snapshots and KVM memory backings for sub-millisecond VM forks involves low-level Linux kernel and hypervisor systems programming.
What it would actually take: Achieving sub-millisecond execution times requires intercepting KVM ioctls, managing guest physical memory via shared memory regions (shm/mmap) with CoW, and state snapshotting. A builder must possess specialized Linux virtualization and systems engineering knowledge, writing low-level Rust/C code to manipulate Firecracker microVM state directly without OS-level process spinup overhead.
Discussion
20 comments analyzed.
Competitors mentioned: WSL (Windows Subsystem for Linux), CodeSandbox, exe.dev
Concerns raised: No networking inside forks limits usability, TTY staleness and renewal issues after freeze, Storage accumulation from version drift in base images, NVMe becomes bottleneck with file system approach, Fault storm problem for longer-running sandboxes
Feature requests: Add virtio-net to forks for networking support, Support for MSVC/CMake/Ninja/Incredibuild toolchains, Run minikube inside for ephemeral cluster testing, Reflink support for tmpfs in Linux kernel
Competitors
Other products that read as similar to this one : 349 launches clear the similarity bar, closest 8 shown.
Attention rank: #10 of 350 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 139 days after the earliest competitor.
- Clone, a small Rust VMM, forks VMs in under 20ms via CoW · hn · 2026-04-19 · 11 upvotes · similarity 0.59
- machine0 · hn · 2026-06-15 · 96 upvotes · similarity 0.52
- Zeroboot · hn · 2026-03-17 · 20 upvotes · similarity 0.52
- RiceVM · hn · 2026-04-02 · 7 upvotes · similarity 0.52
- Tarit · hn · 2026-07-08 · 6 upvotes · similarity 0.52
- Vpod · hn · 2026-06-17 · 12 upvotes · similarity 0.51
- Superserve · hn · 2026-07-21 · 9 upvotes · similarity 0.49
- Forkrun · hn · 2026-03-27 · 151 upvotes · similarity 0.49
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.