Notes from operating the thing.
Everything here comes from systems I built and incidents I had to fix. If a number appears, I measured it in production.
What Scale to Zero Cost Me to Build: 50s Sleeps, 14s Wakes
Hibernate took 50 seconds. Wake took 14, not the 1.3 I had reported. The measured price of building scale to zero on a Firecracker fleet, and every fix.
9 minSep 2, 2026Sandbox Creation Time Benchmarks Measure Different Things
Every AI sandbox matrix has a creation time column spanning 0.79ms to 2.7s. That spread is definitional, not performance. Here's how to make it comparable.
10 minSep 2, 2026Isolation Is Not an Abuse Control: Lessons From My Fleet
A free-tier signup mined crypto on my microVM fleet in 27 minutes. Containment held perfectly and it changed nothing. What I built afterwards, in what order.
9 minSep 2, 2026microVM Production Incidents: 4 Postmortems From My Fleet
Four real postmortems from a multi-tenant Firecracker microVM fleet I run solo: a wiped boot disk, silent config drift, a fatal page fault, and no alerts.
10 minSep 2, 2026Firecracker microVM Cloud, Built Solo in 6 Months: 179ms Boots
What it actually takes to run a Firecracker microVM cloud alone: snapshot-restore on every create, 179ms boots, pre-allocated netns, and the real costs.
9 minSep 2, 2026I Measured Every Stage of My 179ms Firecracker Boot Path
Where every millisecond of a Firecracker create goes, measured on my own production fleet, plus why I refuse to stop the clock before the guest answers.
9 minSep 2, 2026My Fork Docs Were Wrong: What VM Forking Really Preserves
I shipped a doc claiming forks keep processes and open files. A smoke test proved otherwise. Three fork paths measured, and the five places each breaks.
10 minSep 2, 2026Container vs microVM vs gVisor: Choosing Agent Isolation
A practical guide to picking an isolation model for AI-agent code execution, from someone who runs a Firecracker fleet: five models, five axes, one table.
9 minSep 2, 2026Checkpoint Restore Implementation: What It Cost Me to Build
Analysts call checkpoint/restore table stakes by 2027. Here is the real bill: snapshot storage, userfaultfd lazy restore, and a 50s hibernate vs 1.2s wake.
9 minSep 3, 2026Top AI Agent Sandbox Providers: An Engineer's 2026 Roundup
A working engineer's roundup of the top AI agent sandbox providers: isolation, hosting, persistence and pricing compared — including the one I built myself.
10 minSep 3, 2026AI Agent Sandboxes: What They Are and How to Choose One
What an AI agent sandbox is at the systems level, the four properties that decide one, and how 15 platforms compare — from an engineer who built one of them.
10 minSep 3, 2026AI Agent Sandbox Runtime: The Six Options and Who Uses Them
Firecracker, gVisor, Kata, containers, V8 isolates and libkrun compared — how each isolates, what it costs in memory, and which sandbox vendors run it.
10 minSep 3, 2026AI Agent Cloud: What the Term Means and Who Actually Has One
An AI agent cloud needs more than a sandbox: state, hosting, triggers, audit. I map 15 platforms against that stack and show where each one stops short.
10 min