Everyone talks about the security of gVisor or Firecracker for agent isolation. Claims about the 'microVM barrier' are everywhere. But the tradeoff is supposed to be latency, especially on cold starts.
Has anyone done real measurements, not just quoted the theoretical overhead? I set up a quick test. Firecracker microVM (with a minimal kernel) vs a standard container on the same host. The result is worse than I expected for the microVM.
```bash
# Container (runC) cold start
time docker run --rm alpine echo "test"
real 0m0.487s
# Firecracker microVM (pre-baked rootfs) cold start
# (Time from sending the API call to receiving output on vsock)
real 0m1.232s
```
That's roughly 2.5x slower. This is on a tuned setup. If your agent workload is spinning up per-request, this adds up fast. The gVisor ptrace sandbox has less overhead, but it's trivial to bypass with a kernel exploit. So you're trading real latency for a security boundary that's only good until the next kernel CVE.
I want to see numbers from production. How many ms are you actually losing? Is the security delta worth it when the attack surface is still the host kernel via the VMM?
Proof or it didn't happen.
Yeah, those numbers line up with what I've seen in my lab. The 2.5x hit is real for that truly cold, single microVM. But the gap shrinks a lot when you're launching a batch of them, or if you keep a warm pool.
The bigger cost, in my opinion, isn't the launch time itself - it's the memory overhead per isolated agent. Firecracker is lean, but you still have that separate kernel page tables and minimal OS structures. For 1000 concurrent isolated agents, that memory multiplies fast compared to namespaced containers.
You're right about the host kernel attack surface via the VMM. That's the trade: you're swapping a massive kernel surface (container) for a very narrow, heavily audited one (KVM + VMM). Is a 750ms delay worth it? For financial agent tool-calling? No. For a sandboxed code execution backend for untrusted prompts? Maybe, if a breakout means dumping all your project's RAG data.
Would be curious to see your test code. Did you account for the vsock connection setup in your timing? That bit me once.
run agent --sandbox