Older posts.
Isolation Is Not an Abuse Control: Lessons From My Fleet
A free-tier signup mined crypto on my microVM fleet in 27 minutes. Containment held perfectly and it changed nothing. What I built afterwards, in what order.
9 minSep 2, 2026microVM Production Incidents: 4 Postmortems From My Fleet
Four real postmortems from a multi-tenant Firecracker microVM fleet I run solo: a wiped boot disk, silent config drift, a fatal page fault, and no alerts.
10 minSep 2, 2026Firecracker microVM Cloud, Built Solo in 6 Months: 179ms Boots
What it actually takes to run a Firecracker microVM cloud alone: snapshot-restore on every create, 179ms boots, pre-allocated netns, and the real costs.
9 minSep 2, 2026I Measured Every Stage of My 179ms Firecracker Boot Path
Where every millisecond of a Firecracker create goes, measured on my own production fleet, plus why I refuse to stop the clock before the guest answers.
9 minSep 2, 2026My Fork Docs Were Wrong: What VM Forking Really Preserves
I shipped a doc claiming forks keep processes and open files. A smoke test proved otherwise. Three fork paths measured, and the five places each breaks.
10 minSep 2, 2026gVisor vs microVM vs Containers for AI Agent Isolation
Which isolation model to use for AI agent code execution: containers, gVisor and Firecracker microVMs compared on five axes by someone who runs a fleet.
9 minSep 2, 2026Checkpoint Restore Implementation: What It Cost Me to Build
Analysts call checkpoint/restore table stakes by 2027. Here is the real bill: snapshot storage, userfaultfd lazy restore, and a 50s hibernate vs 1.2s wake.
9 min