Is the OP the author of this? Because they are writing responses here that are unquestionably unedited LLM generated responses. The project looks cool, and I'm particularly glad to see a reach for a p2p container registry, but that sort of behavior doesn't lend credibility to something as critical as image infrastructure.
I hate how I feel about this: the sole contributor's account is not 2 month old, and yet they have created an org for this project, with all the bells and whistles in the README.
To me, a project that young, with a unique developer at the helm, cannot look "that nice", so I can't resist seeing it as too nice to be true, and being actually a scam or whatever.
I know that, thanks to AI, a solo dev can not only orchestrate an actual projects in a few days, but can ALSO take time to make a good looking README.
When, in the past, the focus was first on the code, then on the README.
> Why this matters: Modern infrastructure uses too many execution engines — Docker for dev, containerd for production, Firecracker for isolation, CRI for Kubernetes, MCP agents for AI.
It is my understanding that Docker Engine adds capabilities (such as network stack) on top of Containerd (which is a project maintained by the same people), and "CRI for Kubernetes" is a Container Runtime Interface which COULD be something other than Containerd but often is just Containerd. So in essence the reason why yet another runtime exists is that we have a runtime for containers (Docker/Containerd, Containerd and, for example, Containerd as the CRI in K8s), a runtime for isolation and a runtime for AI agents.
That seems like an unnecessary argument on its own, which makes me wonder why it's listed as the first argument.
Where does the microvm kernel/initrd come from? How can it be built?
I just want a system that's as easy as "docker run ubuntu" but launches as a microvm instead, without me having to source a kernel or remember hugenormously long qemu incantation lines.
Looks like everyone is converging on the same idea these days :-)
You might be interested in my project then: https://github.com/virtkit-dev/virtkit (also inspired by smolvm and similar projects). Default kernel included, but can also boot a custom kernel if necessary.
I built it at work to replace years of accumulated tooling around complex multi-stage docker/docker-compose builds. The same workloads now run more securely, often faster, and with much less disk space.
Also acts as a Gitlab executor to run CI jobs in microvms :-)
Obviously built with AI (this would otherwise have been a multi-year effort... and therefore not exist at all!) but I think the design is not bad.
Still beta and under-documented, but already quite usable.
Edit: it's not just a runtime, it also replaces docker build with its own native build engine — the build steps themselves run inside microVMs (not "docker inside a VM"). I haven't seen any other tool actually do that, that's quite fun ;-)
I tried smolvm, and built several single binaries with it for different distros. Less than a month later, those same binaries now silently exit with code 0 and I have absolutely no idea what's wrong or how to diagnose.
The kernel/initrd come from a regular OCI container image — there's no separate VM image format. Any OCI image containing /boot/vmlinux (and optionally /boot/initramfs.cpio.gz) works as a kernel image.
I don't think I've ever seen a kernel or initrd in a container image. The whole point of containers is not to duplicate the kernel, and you definitely don't need an initial ram disk since you already have a running operating system.
you don't have to source one manually — pullrun kernel install fetches a kata containers kernel into ~/.pullrun/kernels/vmlinux-<version>. One-time setup, then the daemon auto-discovers it.
If you run an ubuntu image with a kata kernel, do you have difficulty installing some packages? For example if you need linux-headers-$(uname -r) or linux-modules-extra-$(uname -r), it won't exist in canonical apt repos?
Is the OP the author of this? Because they are writing responses here that are unquestionably unedited LLM generated responses. The project looks cool, and I'm particularly glad to see a reach for a p2p container registry, but that sort of behavior doesn't lend credibility to something as critical as image infrastructure.
Unrelated: I clicked your user profile and wondered what that keybase.io thing was... turns out your proof expired and should no longer be trusted. :P
"That identity proof for <name> is pending, revoked, or non-existent".
It looks like OP only has an account here to self-promote, which also puts them in the same credibility tier as an advertiser.
There's actually two additional sockpuppet accounts (liquid64 / yakimbo90) in here self-promoting. Whole thing is throwing off a ton of red flags.
You're right, this is a duplicate of: https://news.ycombinator.com/item?id=48910087.
I hate how I feel about this: the sole contributor's account is not 2 month old, and yet they have created an org for this project, with all the bells and whistles in the README.
To me, a project that young, with a unique developer at the helm, cannot look "that nice", so I can't resist seeing it as too nice to be true, and being actually a scam or whatever.
I know that, thanks to AI, a solo dev can not only orchestrate an actual projects in a few days, but can ALSO take time to make a good looking README.
When, in the past, the focus was first on the code, then on the README.
[dead]
> Why this matters: Modern infrastructure uses too many execution engines — Docker for dev, containerd for production, Firecracker for isolation, CRI for Kubernetes, MCP agents for AI.
It is my understanding that Docker Engine adds capabilities (such as network stack) on top of Containerd (which is a project maintained by the same people), and "CRI for Kubernetes" is a Container Runtime Interface which COULD be something other than Containerd but often is just Containerd. So in essence the reason why yet another runtime exists is that we have a runtime for containers (Docker/Containerd, Containerd and, for example, Containerd as the CRI in K8s), a runtime for isolation and a runtime for AI agents.
That seems like an unnecessary argument on its own, which makes me wonder why it's listed as the first argument.
Ps: I fear the day keyboards will ship with a "—" button, so we can no longer easily identify AI generated text.
Sweet. I had hoped for someone to make a p2p container registry eventually. There is too much centralization with the current popular registries.
"memmap2" link in readme is broken btw, I think your llm means memmap-rs
Where does the microvm kernel/initrd come from? How can it be built?
I just want a system that's as easy as "docker run ubuntu" but launches as a microvm instead, without me having to source a kernel or remember hugenormously long qemu incantation lines.
Looks like everyone is converging on the same idea these days :-)
You might be interested in my project then: https://github.com/virtkit-dev/virtkit (also inspired by smolvm and similar projects). Default kernel included, but can also boot a custom kernel if necessary.
I built it at work to replace years of accumulated tooling around complex multi-stage docker/docker-compose builds. The same workloads now run more securely, often faster, and with much less disk space. Also acts as a Gitlab executor to run CI jobs in microvms :-)
Obviously built with AI (this would otherwise have been a multi-year effort... and therefore not exist at all!) but I think the design is not bad.
Still beta and under-documented, but already quite usable.
Edit: it's not just a runtime, it also replaces docker build with its own native build engine — the build steps themselves run inside microVMs (not "docker inside a VM"). I haven't seen any other tool actually do that, that's quite fun ;-)
I think `smolvm` may fit the bill? I've been using it to run pi.dev in a sandbox.
https://smolmachines.com/
I tried smolvm, and built several single binaries with it for different distros. Less than a month later, those same binaries now silently exit with code 0 and I have absolutely no idea what's wrong or how to diagnose.
We will be soon including this in Tarit, a firecracker alternative https://github.com/instavm/tarit
Currently we have to supply a kernel to run the OCI as a microVM with a warm pool.
You can do this with libkrun. I use it as a podman backend which works exactly as you describe here.
Error: default OCI runtime "krun" not found: invalid argument
Oh, you do need to install it. e.g. on arch: https://archlinux.org/packages/extra/x86_64/krun/
I do have both podman and crun installed, but I don't see any krun or libkrun packages for ubuntu unfortunately :/
The kernel/initrd come from a regular OCI container image — there's no separate VM image format. Any OCI image containing /boot/vmlinux (and optionally /boot/initramfs.cpio.gz) works as a kernel image.
I don't think I've ever seen a kernel or initrd in a container image. The whole point of containers is not to duplicate the kernel, and you definitely don't need an initial ram disk since you already have a running operating system.
[dead]
And if they don't have a kernel? You just specify kernel + initrd?
you don't have to source one manually — pullrun kernel install fetches a kata containers kernel into ~/.pullrun/kernels/vmlinux-<version>. One-time setup, then the daemon auto-discovers it.
If you run an ubuntu image with a kata kernel, do you have difficulty installing some packages? For example if you need linux-headers-$(uname -r) or linux-modules-extra-$(uname -r), it won't exist in canonical apt repos?
[dead]
[dead]