jomcgi.dev / ember / firecracker

Boot once.
Restore forever.

This site runs untrusted code in Firecracker microVMs. Building the first one took 9.3 seconds. Every sandbox since has woken from disk in about 22 milliseconds. Scroll to see how.

scroll ▼

Firecracker boots a fresh microVM in 15 ms.

The slow part is waiting for a useful guest: kernel up, agent listening, toolchain warm. Measured cold, that wait is 7,484 ms.

So the daemon builds it once, then freezes it.

Every page of guest RAM and every device register is written to disk: a memory file and a vmstate file. Saving the snapshot takes 1,764.9 ms, paid one time at startup.

A request restores.

The bytes map from disk straight back into memory and the guest resumes mid-thought. The readiness wait that cost 7,484 ms cold takes 0.3 ms warm. The whole wake-up: ~22 ms.

And again. And again.

Each restore is a fresh, isolated VM from the same frozen image, then discarded. 12 real recorded runs, end to end, including auth and code execution.

microVM · guest RAM booting
kata-fc · node-local vcpu 1 · jailed
base.mem
every page of guest RAM
base.vmstate
device + vcpu state
run 01 52.0 ms
run 02 43.3 ms
run 03 43.2 ms
run 04 42.6 ms
run 05 44.1 ms
run 06 42.2 ms
run 07 42.2 ms
run 08 43.5 ms
run 09 44.1 ms
run 10 42.3 ms
run 11 42.8 ms
run 12 44.8 ms
cold: build the base snapshot (once, at daemon startup) 0 ms
waiting for a useful guest · 7,484 ms
warm: restore from the snapshot (every request) 52 ms
same scale. really.
that sliver, magnified · run #1 of 12
verify the caller 3.8 ms disk → memory 22.3 ms guest ready 0.3 ms run the code 25.6 ms

Feel it. Restore one now.

This button replays one of the 12 recorded runs at its true speed. No cluster is touched: the timings below were captured from the live daemon and baked into this page.

restores: 0
run – of 12
auth_tokenreview · verify the caller 3.8 ms acquire_slot · take a slot 0.0 ms snapshot_restore · disk → memory 22.3 ms guest_wait_ready · guest ready 0.3 ms guest_exec · run the code 25.6 ms
Every number on this page is a real measurement exported by the daemon's own tracing, recorded and baked in at build time. Warm restores: 12 consecutive live runs.
source: projects/embervm

Boot once. Restore forever.

This site runs untrusted code in Firecracker microVMs. Building the first one took 9.3 seconds. Every sandbox since has woken from disk in about 22 milliseconds.

Cold, once at startup: 9,264 ms

firecracker_boot 15.1 ms · guest_wait_ready 7484.0 ms · snapshot_save 1764.9 ms

Warm, every request: 42–52 ms

The snapshot restore itself is a steady ~22 ms across all 12 recorded runs.