FastVM

At a glance

FastVM is an early Go daemon and CLI that runs each sandbox as a Firecracker microVM on one Linux KVM host. Idle sandboxes pause themselves, then hand their RAM to a memory file on disk. The VMM stays alive in a paused state, so an inbound request lands in the guest's network queue and wakes it. The author's repository note reads "Fully vibed. Read the idea, ignore the code please :)".

Good fit

Someone exploring how a self-hosted sandbox can sleep when idle and wake on traffic, for example a dev preview server published on a host port that should give memory back between visits. It also suits reading as a design study: GOAL.md lays out the wake path, memory offload and the reasons it keeps the VMM process running.

Consider something else when

You need something to run untrusted workloads in production. This is a v0.1 project with no releases, and the author asks readers to ignore the code. Also skip it if you lack a Linux x86_64 host with KVM and root, or need sandboxes spread across machines, macOS or Windows.

Start here

On a KVM host with Firecracker, Go 1.24+ and Docker, run make build && make assets, then sudo make demo. The demo builds a disk from a Dockerfile, publishes port 8080, waits for the sandbox to reach Dormant, then curls it. Success is the page text returned and wake_count: 1.

Cost and requirements

No price is stated, and the repository root lists no licence file. It needs Linux x86_64 with accessible /dev/kvm, Firecracker v1.10 or later (v1.17 tested), Go 1.24+ to build, and root or CAP_NET_ADMIN for TAP, bridge and nftables setup. Docker is needed only for fastvm build; e2fsprogs and nft are also required.

Limits to know

Sandboxes share the daemon's network namespace, isolated only by bridge port isolation and static rules. The eBPF switch is not wired in, even though the README's default config names it. After a daemon restart, sandboxes that were Running or Paused are marked failed. Only file and never memory offload work. Guest servers must listen on IPv4, and the serial console is not reattached after a restore.

Related work

• Microsandbox: another way to run untrusted code in local microVMs booted from OCI images (alternative)
• Blaxel: hosted agent sandboxes that suspend and resume, if you would rather not run KVM yourself (alternative)

Still unclear

• The README says sandboxes boot in about 100 ms, and GOAL.md sets wake-latency targets, but no published benchmark shows measured boot or wake times on a stated host.