Thread

1. Normal_gaussian · 1790802926 · focus · HN ↗

   I've been using SlicerVM extensively - which is Firecracker MicroVMs for the regular person (and for the irregular with their platform offering) - to run local 'edge' style workloads locally and securly. Agents, local dev CI, etc. It slotted in and replaced my proxmox vm orchestrator, and now I have secure and and fast vms on my laptop wherever I go. It also supports dockerfile style builds if you're wanting a security upgrade from containers (which, you should if you're using agents).

   Honestly, while I see firecracker replacing docker on the horizon I don't see firecracker replacing v8 isolates for most edge function execution. Firstly, this article's scenario is a bit unusual in that they were using someone else's isolates - so adding on a few hops; secondly isolates running JS/TS can be statically analyzed quite well, and at scale looking historically for issues and exploits, in many edge compute scenarios this is quite desirable. MicroVMs can have an awful lot more flexibility so to get the same benefit you have to really lock down what is available - the trade-offs for mid-size companies seems to benefit isolates. Obviously netlify is more than big enough and relies heavily on this that it leans in their favour.

   1. jst1fthsdys · 1790803807 · focus · HN ↗

      25 USD/m to run a daemon on my own hardware. Yikes.

      1. binsquare · 1790806021 · focus · HN ↗

         That seems off to me as well.

         Fwiw, you can run this instead free and open source: <a href="https:&#x2F;&#x2F;github.com&#x2F;smol-machines&#x2F;smolvm" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;smol-machines&#x2F;smolvm

         Disclaimer: Am author.

         1. dprkh · 1790838210 · focus · HN ↗

            Why is this better than just using Docker?

            1. binsquare · 1790840212 · focus · HN ↗

               Kernel level isolation.

               Functionality of criu built in so you can get rewind, pause, in an accessible manner.

               Embeddable (you can write JavaScript to programmatically use an isolated environment)

               Native performance on multiplatform + consistent experience across platforms.

               1. stavros · 1790844765 · focus · HN ↗

                  This sounds great. By the way, does &quot;kernel-level isolation&quot; mean &quot;you have to allocate a chunk of RAM to this&quot;? Or is that CPU-level?

                  EDIT: Ah, looks like it means &quot;runs its own kernel&quot;, not &quot;isolates at the kernel&quot; like Docker does.

                  1. binsquare · 1790848288 · focus · HN ↗

                     yes, separate kernels + virtualized hardware via hypervisor.

                     containers are built on linux primitives &amp; so shares the kernel.

                     1. stavros · 1790850989 · focus · HN ↗

                        Excellent, thank you. This is definitely useful to me.

Unofficial Hacker News client; not affiliated with Y Combinator.