microVMs

MicroVMs offer hardware-enforced isolation for workloads, combining VM security with container-like speed and efficiency.

MicroVMs are lightweight virtual machines providing strong hardware-level isolation per workload, each running its own Linux kernel within a KVM-enforced boundary. They boot in milliseconds (e.g., Firecracker microVMs in ~0.1 seconds) and maintain a minimal memory footprint (around 5MB overhead), making them ideal for high-density, multi-tenant, or untrusted code execution scenarios like AI sandboxes and serverless functions. Unlike containers, which share the host kernel, microVMs offer a superior security boundary, crucial for applications where a shared kernel is an unacceptable risk. Key implementations include Firecracker (powering AWS Lambda and Fargate), Cloud Hypervisor, and QEMU microVM.

https://aws.amazon.com/lambda/microvms/