ngosangns Knowledge Base

#microvm

  • Building Your Own Sandboxes
    Notes on Alfonso Campodonico's "Building your own sandboxes" (2026-10-18) - vmkit runs Firecracker or Cloud Hypervisor microVMs behind one API, each VMM inside a rootless namespace jail with a default-deny per-VM network, and kiln turns OCI images into one-erofs-per-layer microVM images. Main lesson - the VMM is the easy part, the policy around it is the work.