# First spawn (cold boot) - ~1 second 1. Start Firecracker process 2. Boot kernel + rootfs 3. Wait for guest agent to signal ready 4. Pause the VM 5. Snapshot memory + CPU + devices to disk 6. Resume the VM, hand it to the user # Every subsequent spawn - ~28ms 1. Copy the snapshot files (copy-on-write, nearly instant) 2. Start new Firecracker process with --restore-from-snapshot 3. VM resumes exactly where the snapshot was taken 4. Guest agent is already running, already ready # First spawn (cold boot) - ~1 second 1. Start Firecracker process 2. Boot kernel + rootfs 3. Wait for guest agent to signal ready 4. Pause the VM 5. Snapshot memory + CPU + devices to disk 6. Resume the VM, hand it to the user # Every subsequent spawn - ~28ms 1. Copy the snapshot files (copy-on-write, nearly instant) 2. Start new Firecracker process with --restore-from-snapshot 3. VM resumes exactly where the snapshot was taken 4. Guest agent is already running, already ready # First spawn (cold boot) - ~1 second 1. Start Firecracker process 2. Boot kernel + rootfs 3. Wait for guest agent to signal ready 4. Pause the VM 5. Snapshot memory + CPU + devices to disk 6. Resume the VM, hand it to the user # Every subsequent spawn - ~28ms 1. Copy the snapshot files (copy-on-write, nearly instant) 2. Start new Firecracker process with --restore-from-snapshot 3. VM resumes exactly where the snapshot was taken 4. Guest agent is already running, already ready func (f *FirecrackerProvider) Spawn(ctx context.Context, opts SpawnOptions) (string, error) { // Check if we have a snapshot for this image snap := f.getSnapshot(opts.Image) if snap != nil { // Fast path: restore from snapshot (~28ms) return f.restoreFromSnapshot(ctx, snap, opts) } // Slow path: cold boot + create snapshot (~1s) vm, err := f.coldBoot(ctx, opts) if err != nil { return "", err } // Wait for guest agent to be ready f.waitForAgent(ctx, vm) // Pause VM and snapshot f.pauseVM(ctx, vm) f.createSnapshot(ctx, vm) f.resumeVM(ctx, vm) return vm.ID, nil } func (f *FirecrackerProvider) Spawn(ctx context.Context, opts SpawnOptions) (string, error) { // Check if we have a snapshot for this image snap := f.getSnapshot(opts.Image) if snap != nil { // Fast path: restore from snapshot (~28ms) return f.restoreFromSnapshot(ctx, snap, opts) } // Slow path: cold boot + create snapshot (~1s) vm, err := f.coldBoot(ctx, opts) if err != nil { return "", err } // Wait for guest agent to be ready f.waitForAgent(ctx, vm) // Pause VM and snapshot f.pauseVM(ctx, vm) f.createSnapshot(ctx, vm) f.resumeVM(ctx, vm) return vm.ID, nil } func (f *FirecrackerProvider) Spawn(ctx context.Context, opts SpawnOptions) (string, error) { // Check if we have a snapshot for this image snap := f.getSnapshot(opts.Image) if snap != nil { // Fast path: restore from snapshot (~28ms) return f.restoreFromSnapshot(ctx, snap, opts) } // Slow path: cold boot + create snapshot (~1s) vm, err := f.coldBoot(ctx, opts) if err != nil { return "", err } // Wait for guest agent to be ready f.waitForAgent(ctx, vm) // Pause VM and snapshot f.pauseVM(ctx, vm) f.createSnapshot(ctx, vm) f.resumeVM(ctx, vm) return vm.ID, nil } [4 bytes: message length][JSON payload] [4 bytes: message length][JSON payload] [4 bytes: message length][JSON payload] {"type": "exec", "command": "python3 /app/main.py", "workdir": "/workspace"} {"type": "exec", "command": "python3 /app/main.py", "workdir": "/workspace"} {"type": "exec", "command": "python3 /app/main.py", "workdir": "/workspace"} {"type": "stdout", "data": "hello world\n"} {"type": "exit", "code": 0} {"type": "stdout", "data": "hello world\n"} {"type": "exit", "code": 0} {"type": "stdout", "data": "hello world\n"} {"type": "exit", "code": 0} providers: default: "firecracker" # or "-weight: 500;">docker" -weight: 500;">docker: runtime: "runc" # or "runsc" for gVisor providers: default: "firecracker" # or "-weight: 500;">docker" -weight: 500;">docker: runtime: "runc" # or "runsc" for gVisor providers: default: "firecracker" # or "-weight: 500;">docker" -weight: 500;">docker: runtime: "runc" # or "runsc" for gVisor // scopedPath prevents user A from accessing user B's workspace func scopedPath(vmID, sandboxID, path string) string { if vmID == "" { return path // 1:1 mode, no scoping } base := "/workspace/" + sandboxID cleaned := filepath.Clean(filepath.Join(base, path)) if !strings.HasPrefix(cleaned, base+"/") && cleaned != base { return base // traversal attempt, return base } return cleaned } // scopedPath prevents user A from accessing user B's workspace func scopedPath(vmID, sandboxID, path string) string { if vmID == "" { return path // 1:1 mode, no scoping } base := "/workspace/" + sandboxID cleaned := filepath.Clean(filepath.Join(base, path)) if !strings.HasPrefix(cleaned, base+"/") && cleaned != base { return base // traversal attempt, return base } return cleaned } // scopedPath prevents user A from accessing user B's workspace func scopedPath(vmID, sandboxID, path string) string { if vmID == "" { return path // 1:1 mode, no scoping } base := "/workspace/" + sandboxID cleaned := filepath.Clean(filepath.Join(base, path)) if !strings.HasPrefix(cleaned, base+"/") && cleaned != base { return base // traversal attempt, return base } return cleaned } -weight: 500;">git clone https://github.com/DohaerisAI/forgevm && cd forgevm ./scripts/setup.sh ./forgevm serve -weight: 500;">git clone https://github.com/DohaerisAI/forgevm && cd forgevm ./scripts/setup.sh ./forgevm serve -weight: 500;">git clone https://github.com/DohaerisAI/forgevm && cd forgevm ./scripts/setup.sh ./forgevm serve from forgevm import Client client = Client("http://localhost:7423") with client.spawn(image="python:3.12") as sb: result = sb.exec("print('hello from a 28ms sandbox')") print(result.stdout) from forgevm import Client client = Client("http://localhost:7423") with client.spawn(image="python:3.12") as sb: result = sb.exec("print('hello from a 28ms sandbox')") print(result.stdout) from forgevm import Client client = Client("http://localhost:7423") with client.spawn(image="python:3.12") as sb: result = sb.exec("print('hello from a 28ms sandbox')") print(result.stdout) - virtio-block (disk) - virtio-net (network) - serial console - 1-button keyboard (just to -weight: 500;">stop the VM) - Its own Linux kernel - Its own root filesystem - Its own network namespace - Communication with the host via vsock (virtio socket, not TCP) - Firecracker process starts (~50ms) - Load kernel into memory (~100ms) - Kernel boots, init runs (~500ms) - Guest agent starts and signals ready (~200ms) - Full memory contents (the entire RAM, written to a file) - CPU register state (instruction pointer, stack pointer, all registers) - Device state (virtio queues, serial port state) - ~5ms: Firecracker process startup - ~8ms: mmap the memory snapshot file - ~10ms: restore CPU and device state - ~5ms: vsock reconnection and ready signal - The base snapshot is read-only - Each new VM gets a CoW overlay for both the memory file and the rootfs - Writes go to the overlay, reads fall through to the base - On destroy, delete the overlay. Base snapshot stays pristine. - Listens on vsock for commands from the host - Executes commands via os/exec - Handles file read/write/list/delete operations - Streams stdout/stderr back to the host in real-time - Uses a length-prefixed JSON protocol over the vsock connection - Boot: ~200-500ms - Isolation: Linux namespaces + cgroups + seccomp - Attack surface: Shared host kernel. Every syscall from the container hits the real kernel. - KVM needed: No - Runs on: Linux, Mac, Windows - Boot: ~28ms (snapshot) / ~1s (cold) - Isolation: KVM hardware virtualization. Separate kernel per sandbox. - Attack surface: Minimal VMM with 4 devices. Guest kernel is a separate kernel. - KVM needed: Yes - Runs on: Linux with /dev/kvm - Boot: ~300-800ms - Isolation: User-space kernel intercepts syscalls. ~70 host syscalls exposed. - Attack surface: Much smaller than Docker, larger than Firecracker. - KVM needed: No - Runs on: Linux - Routes all exec calls to the shared VM but sets WorkDir to the user's workspace - Rewrites all file paths through scopedPath() to prevent directory traversal - Tracks user count per VM and creates new VMs when capacity is full - Destroys VMs only when all users have left