Korva is a scroll of the internet’s best ideas.
Pause the sandbox while you wait
Take a code review agent. It clones a customer's PR, checks out the code, diffs the changes, and analyzes the codebase. The work has to run in a virtual machine isolated from other customers, so one customer's code never mixes with another's. For thousands of customers, that could mean a thousand VMs on constantly.
With durable execution wrapped around the sandbox, the lifecycle is managed in the function: create the sandbox, run steps to review the code, then wait for an event such as the PR being approved, rejected, or updated with new code. During that wait the sandbox pauses, with no active CPU cost.
The orchestrator also stays outside. Putting one inside every sandbox means paying for a lot of RAM across thousands of copies. One orchestrator managing many sandboxes lets each sandbox be much lighter.
Why do customers' code reviews need separate VMs?
Containers share the host's operating system kernel, so a flaw in that kernel could let one customer's code reach another's. A virtual machine puts a hypervisor between them, which presents a much smaller attack surface. AWS built Firecracker, a lightweight virtual machine monitor behind Lambda and Fargate, to give this isolation with fast startup, and its microVMs can boot in as little as 125 milliseconds.
How can a sandbox pause without losing its state?
Hypervisors can suspend a virtual machine by writing its memory contents and processor state to storage, then loading them back later. While the machine is suspended it uses no processor time, and only the storage for the saved snapshot is paid for. Firecracker supports snapshotting a microVM's memory and device state so it can resume where it stopped.
Why does the orchestrator stay outside the sandbox?
Every orchestrator process carries a baseline of memory for its runtime and libraries, and copying it into thousands of sandboxes multiplies that cost. A single orchestrator outside also keeps running when a sandbox is paused. A suspended sandbox cannot run code that wakes it up, so something outside has to be watching for the event it is waiting on.
More from The Peel with Turner Novak
