Containers vs. KVM-Based VMs (AWS Lambda MicroVMs and EC2) for Agentic Sandboxes
Bare metal: A physical server.
Hypervisor: A software layer that runs on a bare-metal server and enables virtualization.
- A Type 1 hypervisor (also known as a bare-metal hypervisor) runs directly on physical bare-metal hardware for high-performance enterprise servers, while a Type 2 hypervisor runs as an application on top of an existing host operating system (like Windows, macOS, or Linux) for personal desktops and testing
A virtual machine is a distinct computer with its own virtual kernel, while a container uses the actual kernel of the host system.
Two isolation models:
Shared host kernel: Containers share the host OS kernel.
Independent guest kernel: VMs run their own guest OS kernel.
Containers: Use a shared host kernel, offering fast startup times but weaker isolation boundaries than VMs.
KVM-based VMs (e.g., EC2 and Lambda MicroVMs): Provide strong isolation through independent guest kernels. Traditional EC2 instances generally take longer to boot, while AWS Lambda MicroVMs powered by Firecracker are designed for fast startup.
Firecracker MicroVM: A lightweight VM technology designed for secure and fast startup. It uses KVM and a minimalist design to reduce overhead.
- Firecracker is minimalist by design, including only the components needed to run secure and lightweight VMs.
- AWS reference: Meet Firecracker: An open source, secure, fast microVM for serverless computing
- Note: Firecracker MicroVMs are not the same as EC2 instances. Firecracker is a virtual machine monitor (VMM) that uses KVM to create lightweight microVMs. EC2 instances can use different underlying virtualization technologies.