Run MVM

Secure microVMs for AI agents, code interpreters & multi-tenant AI. Isolation in the runtime not your code. Self-host, BYOC, or Cloud.

[Run MVM @gorunmvm]

AI agents just poked at U.S. government systems without their own operators knowing.

The problem isn't the model. It's that nobody defined what the agent was allowed to execute.

That's what we're building. Our first video 👇
https://t.co/ZygWCDDutC

[Run MVM @gorunmvm]

~100 malicious models on Hugging Face. No CVE, because pickle was working as designed.

Every one of them would've been a non-event inside mvm: scanned before load, and sealed in a microVM with no network and no credentials even if missed.
https://t.co/AST95s8INA

[Run MVM @gorunmvm]

The scariest outages aren't when something dies. They're when everything is technically up and lying to each other: a healthy node serving stale data, retries turning one 200ms hiccup into a self-inflicted flood. Crashes page you. Ambiguity ruins your night.

[Run MVM @gorunmvm]

Kubernetes has no idea what a container actually is. It hands the whole thing to a runtime over a socket and trusts whatever comes back. That CRI boundary is exactly why you can swap runc for crun for kata and the scheduler never notices. Best abstraction in the whole stack.

[Run MVM @gorunmvm]

Flue showed up in this week's issue: an open agent framework that treats execution as something you sandbox from the start. Nice to see isolation baked in at the framework layer instead of bolted on after the first incident. https://t.co/THi94Pi0Qp https://t.co/etA2RJudZZ

[Run MVM @gorunmvm]

Hyperlight runs a microVM with no kernel and no OS inside it — just your function in a hardware-isolated address space. Boot drops to microseconds because there's nothing left to boot. Different bet than Firecracker: isolate the function, not the machine.

[Run MVM @gorunmvm]

Building a micro Linux distro from scratch is the fastest way to see why microVM boots are so fast: you watch exactly how little sits between power-on and userspace. Good read in this week's issue. https://t.co/3YKMOCbQn3 https://t.co/etA2RJudZZ

[Run MVM @gorunmvm]

Memory ballooning is how a microVM hands RAM back to the host without a reboot: the guest inflates a balloon of pages it promises not to touch, and the host reclaims them. Great density trick, until you hit real memory pressure and it bites.

[Run MVM @gorunmvm]

AWS put a name on the substrate: Lambda now runs on published MicroVMs. Serverless was always Firecracker underneath — but saying it out loud makes per-request isolation the default people expect. https://t.co/sdQEB9LZic https://t.co/etA2RJudZZ

[Run MVM @gorunmvm]

This Week in MicroVMs №4 is out.

AWS just put the word "microVM" on a product page — Lambda MicroVMs ship for user- and AI-generated code. Plus Edera on multi-tenant workloads, BSidesCharm's case for microVMs, and Flue.

https://t.co/etA2RJudZZ

[Run MVM @gorunmvm]

We spent fifteen years teaching hypervisors to do more — live migration, hotplug, full device models — and the winning move for cloud was to delete most of it. Firecracker is basically Xen's lessons run in reverse.

[Run MVM @gorunmvm]

What I track each week is basically: which VMM shipped something, which sandbox showed up new, and which CVE proved a boundary was thinner than people assumed. This week had all three. https://t.co/etA2RJudZZ

[Ivan Velichko @iximiuz]

Vital for understanding how microVM sandboxes work in particular.

[Run MVM @gorunmvm]

forkd is a clean example of this aimed squarely at agents: ~100 child VMs in ~100ms off a single parent. that's the math that makes a fresh isolated VM per agent action — per tool call, per generated snippet — actually affordable. https://t.co/hPHnlimI6b https://t.co/etA2RJudZZ

[Run MVM @gorunmvm]

per-request VMs sound absurd until you realize nobody fast actually boots them. the whole game is getting a VM to exist without running a boot path. once you internalize that, the cold-start economics flip.

[Run MVM @gorunmvm]

fork pushes it further. keep one warm parent paused, then copy-on-write the memory for each child. children share pages until they write, so you spin up a swarm off one snapshot without re-paying the per-VM memory cost. cold start becomes a memory-mapping problem.

[Run MVM @gorunmvm]

the old objection was speed, and it aged out — per-request VMs boot in single-digit ms today. so the real question for anyone running agent code: why is your isolation boundary still a kernel feature instead of a kernel? https://t.co/iFzokpLfkX https://t.co/etA2RJudZZ

[Run MVM @gorunmvm]

a container was never a trust boundary. it's a packaging format with namespaces bolted on. that was fine when you wrote the code inside it. you don't anymore — an agent does, and the threat model flipped under everyone's feet.

[Run MVM @gorunmvm]

a microVM moves the boundary down to hardware. separate kernel, separate address space, a VMM exposing a handful of virtio devices instead of 300 syscalls. an escape now means breaking the CPU's isolation, not finding a race in shared kernel code.