https://www.ajayk.sh Deep technical writing on cloud infrastructure, microVMs, isolation and running production systems — from an engineer who operates what he writes about. en Wed, 02 Sep 2026 09:11:57 GMT https://www.ajayk.sh/blog/scale-to-zero-infrastructure-economics/ https://www.ajayk.sh/blog/scale-to-zero-infrastructure-economics/ Hibernate took 50 seconds. Wake took 14, not the 1.3 I had reported. The measured price of building scale to zero on a Firecracker fleet, and every fix. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) scale-to-zero firecracker infrastructure-cost microvm hibernation ai-infrastructure https://www.ajayk.sh/blog/sandbox-creation-time-benchmarks-mislead/ https://www.ajayk.sh/blog/sandbox-creation-time-benchmarks-mislead/ Every AI sandbox matrix has a creation time column spanning 0.79ms to 2.7s. That spread is definitional, not performance. Here's how to make it comparable. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) benchmarking microvm firecracker ai-agents performance infrastructure https://www.ajayk.sh/blog/running-untrusted-ai-code-isolation/ https://www.ajayk.sh/blog/running-untrusted-ai-code-isolation/ A free-tier signup mined crypto on my microVM fleet in 27 minutes. Containment held perfectly and it changed nothing. What I built afterwards, in what order. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) security isolation firecracker microvm abuse multi-tenancy ai-agents https://www.ajayk.sh/blog/lessons-operating-production-microvm-fleet/ https://www.ajayk.sh/blog/lessons-operating-production-microvm-fleet/ Four real postmortems from a multi-tenant Firecracker microVM fleet I run solo: a wiped boot disk, silent config drift, a fatal page fault, and no alerts. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) microvm firecracker sre postmortem gcp incident-response infrastructure https://www.ajayk.sh/blog/i-built-a-firecracker-cloud-solo/ https://www.ajayk.sh/blog/i-built-a-firecracker-cloud-solo/ What it actually takes to run a Firecracker microVM cloud alone: snapshot-restore on every create, 179ms boots, pre-allocated netns, and the real costs. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) firecracker microvm infrastructure go solo-founder kvm gcp https://www.ajayk.sh/blog/firecracker-boot-179ms-anatomy/ https://www.ajayk.sh/blog/firecracker-boot-179ms-anatomy/ Where every millisecond of a Firecracker create goes, measured on my own production fleet, plus why I refuse to stop the clock before the guest answers. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) firecracker microvm performance snapshot-restore instrumentation infrastructure https://www.ajayk.sh/blog/copy-on-write-vm-fork-for-ai-agents/ https://www.ajayk.sh/blog/copy-on-write-vm-fork-for-ai-agents/ I shipped a doc claiming forks keep processes and open files. A smoke test proved otherwise. Three fork paths measured, and the five places each breaks. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) firecracker microvm copy-on-write ai-agents infrastructure snapshots https://www.ajayk.sh/blog/choosing-isolation-for-agent-workloads/ https://www.ajayk.sh/blog/choosing-isolation-for-agent-workloads/ A practical guide to picking an isolation model for AI-agent code execution, from someone who runs a Firecracker fleet: five models, five axes, one table. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) isolation firecracker gvisor containers microvm ai-agents infrastructure https://www.ajayk.sh/blog/checkpoint-restore-what-it-costs-to-build/ https://www.ajayk.sh/blog/checkpoint-restore-what-it-costs-to-build/ Analysts call checkpoint/restore table stakes by 2027. Here is the real bill: snapshot storage, userfaultfd lazy restore, and a 50s hibernate vs 1.2s wake. Wed, 02 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) checkpoint-restore firecracker userfaultfd microvm snapshots ai-infrastructure https://www.ajayk.sh/blog/top-ai-agent-sandbox-providers/ https://www.ajayk.sh/blog/top-ai-agent-sandbox-providers/ A working engineer's roundup of the top AI agent sandbox providers: isolation, hosting, persistence and pricing compared — including the one I built myself. Thu, 03 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) ai-agents sandbox comparison firecracker gvisor infrastructure buyers-guide https://www.ajayk.sh/blog/ai-agent-sandboxes-explained/ https://www.ajayk.sh/blog/ai-agent-sandboxes-explained/ What an AI agent sandbox is at the systems level, the four properties that decide one, and how 15 platforms compare — from an engineer who built one of them. Thu, 03 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) ai-agents sandboxes firecracker microvm gvisor isolation infrastructure https://www.ajayk.sh/blog/ai-agent-sandbox-runtime-comparison/ https://www.ajayk.sh/blog/ai-agent-sandbox-runtime-comparison/ Firecracker, gVisor, Kata, containers, V8 isolates and libkrun compared — how each isolates, what it costs in memory, and which sandbox vendors run it. Thu, 03 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) runtime firecracker gvisor kata-containers libkrun v8-isolates ai-agents comparison https://www.ajayk.sh/blog/ai-agent-cloud-what-it-means/ https://www.ajayk.sh/blog/ai-agent-cloud-what-it-means/ An AI agent cloud needs more than a sandbox: state, hosting, triggers, audit. I map 15 platforms against that stack and show where each one stops short. Thu, 03 Sep 2026 00:00:00 GMT hello@ajayk.sh (Ajay Kumar) ai-agents agent-infrastructure sandboxes microvm platform-engineering cloud