What Are MicroVMs
How MicroVMs Combine VM Isolation With Fast Startup
A microVM is a lightweight virtual machine that uses a hypervisor to isolate a workload, with a minimal set of virtual devices so that it starts far faster than a standard VM. It is a stripped-down virtual machine rather than a different kind of technology.
Like a regular VM, a microVM runs its own guest kernel on top of a hypervisor, usually KVM on Linux. This gives it hardware-level isolation. A problem inside one microVM is much harder to spread to others than a problem inside a container that shares the host kernel.
The difference lies in what the virtual machine includes. A typical VM emulates a full set of hardware, including firmware, disk controllers, graphics and devices the guest may never use. A microVM keeps only what a workload needs, such as a network interface, a block device and a serial console. Less to emulate means less to boot and a smaller attack surface.
The result is fast startup and low memory overhead. Some dedicated microVM monitors report boot times well under a second, which is far quicker than many general-purpose VMs. Isolation between workloads is still enforced by the hardware features covered in VM isolation.
Firecracker and Where MicroVMs Are Used
Firecracker is an open-source virtual machine monitor released by Amazon Web Services. It is written in Rust, runs on KVM and emulates only a small set of devices. AWS uses it to run serverless functions and managed containers, which is why microVMs are often associated with those services. Other projects include Cloud Hypervisor, and Kata Containers, which runs each container inside a lightweight VM.
Serverless and multi-tenant platforms are the main users. They run code from many customers on shared machines. Giving each function or container its own microVM means one customer's code normally cannot read another's memory. Because microVMs start quickly, they can be created for a single task and destroyed afterwards.
Running Untrusted Code Safely in a MicroVM
An online service judges programming submissions written by strangers. Running each submission in an ordinary container would share the host kernel with every other submission. Running each one in a microVM gives it a separate guest kernel, so an exploit inside one run stays contained. The microVM is discarded when the job finishes, and the next submission starts clean.
Frequently asked questions
Is a MicroVM the Same as a Container?
No. A container shares the host's kernel and separates processes with namespaces and cgroups. A microVM has its own guest kernel and is separated by the hypervisor, which gives stronger isolation. The trade-off is that containers usually carry less overhead and are simpler to package. See containers vs virtual machines for the wider comparison.
Can I Run MicroVMs on a Regular VPS?
Often not directly. Running microVMs requires KVM support on the host, and a virtual server must pass hardware virtualization through to its own guests, which is called nested virtualization. Some VPS plans do not offer this. Ask the provider whether the plan supports it before planning a microVM setup.
Are MicroVMs Only Used by Cloud Providers?
No. Open-source microVM monitors run on any Linux host with KVM support, and projects such as Kata Containers make microVMs available inside container platforms. Cloud providers use them at scale, but they are not limited to that use.