Project
Open-source AWS virtual machine monitor that creates lightweight, secure microVMs with sub-second boot times for serverless and container isolation.
Linux kernel flaw CVE-2026-99999 let pwn.ai's Paulos Yibelo read about 32 bytes of host memory per packet from Vercel's production sandboxes. Operators who host other people's VMs need the fix in the kernel the host itself runs.
Reality
AWS Lambda now runs port-listening HTTP servers such as Express and Fastify, with up to 128 concurrent requests per environment. Billing moves to CPU time used, while memory is metered for the life of the environment.
Reality
DepthFirst published a working Ubuntu 26.04 exploit for CVE-2026-80521 on 2026-09-22, before distribution kernels carried a fix, according to a dev.to post. The flaw sits in AF_UNIX, which default Docker and Kubernetes seccomp profiles permit.
Reality
Netlify moved Edge Functions off hosted V8 isolates onto Firecracker MicroVMs in its own network, cutting warm overhead from 25-40 ms to a 5-6 ms median. A dev.to analysis argues that for other edge teams, removing an external network hop can matter as much as a faster runtime.
Reality
Cloudflare has fixed a flaw in Containers that let a Workers Paid account read the 60 KiB it had not written inside each 64 KiB disk block it touched. The fleet-wide fix needed no customer configuration changes.
Reality
FTL ran an unmodified Rust HTTP server on its v0.0.1 user-space kernel in September, with no hardware virtualization underneath. Its claim of VM-grade isolation depends on the small shared kernel that every container still calls into.
Reality
xAI's Grok Bot documentation tells users not to treat separate Bots as a security boundary. OpenAI's Dots and Meta's Muse put their isolation in other places, so what a deployer has to wall off depends on which agent it runs.
Reality
DigitalOcean Managed Agents brought a paused process back with its in-memory counter intact after more than four minutes, in one developer's independent test. That puts the preview service in a different class from ordinary containers for parking long-lived agents mid-task.
Reality
The kernel fixed CVE-2026-80521 on August 6. Ubuntu has shipped nothing for 22.04, 24.04 or 26.04, including its AWS, Azure and GCP kernels, and DepthFirst's exploit for 26.04 went public on September 22.
Reality
The three escapes used a kernel bug disclosed weeks earlier, a libslirp flaw Debian 12 has yet to fix, and 0-days the agent found itself after QEMU was rebuilt from upstream. It is one researcher's account.
Reality
Amazon patched a symlink-following chown in Firecracker's jailer that only affected aarch64. Behind it sits a seccomp policy that permits io_uring, and researcher antitree shows how that hands back file-system calls the filter denies.
Reality
An unaffiliated 10-trial benchmark clocked Blacksmith's runners at 3.17x and 3.77x faster than ubuntu-latest, with no overlap in the ranges. Reaching that baseline first meant moving the repository off a personal account.
Reality
A two-week, $1m escape challenge against Vercel's Firecracker sandbox produced 1,285 reports. The most valuable one hit the Linux kernel networking stack that many clouds use to isolate tenants, and its CVEs are pending.
Reality
AWS's account of rebuilding Lambda's network flow logging explains why per-tenant iptables rules grew more expensive per packet as a worker filled up, and why the module's missing IPv6 support closed off any fix by tuning.
Reality
Firecracker's sub-200ms boot is real, but it only counts on a host you are already paying for by the hour, which is why an experimental GitHub Actions runner project stands or falls on its author's scheduler.
Reality
A dev.to walkthrough on sandboxing LLM tool calls names old web-app failure modes and old web-app controls. The delta is when you apply them: at registration, not after the first exfiltration.
Reality
Devin Outposts on Modal moves code execution into infrastructure the customer runs, which makes a sandbox vendor, not a model vendor, the thing platform teams must procure and secure.
Reality
Encore's crackling drives Firecracker on Linux and Apple's hypervisor on macOS. Getting one set of images to boot on both meant re-implementing much of what Docker and a Linux host do for free.
Reality
A developer who once preached managed databases now runs Postgres on a Firecracker microVM. The interesting part is not the price gap, it is which job moves back onto your desk.
Reality