Containers Overview
Sandboxed containers featuring live migration, Stateful OverlayFS, and native VPC integration.
What are Containers in microsrv?
The microsrv platform enables you to run OCI-compliant containers within strongly isolated, secure sandboxes.
Unlike standard container runtimes (Docker, containerd, Kubernetes) where containers share the host Linux kernel and rely on volatile filesystems, microsrv containers provide the persistence and resilience of dedicated virtual machines:
- Kernel-level isolation without hypervisor overhead: Application system calls are intercepted and handled in user-space by the Sentry sandbox kernel.
- Persistent Storage (Stateful OverlayFS): Root filesystem modifications are persisted directly onto a replicated NVMe volume, surviving restarts and host rescheduling (unlike ephemeral Kubernetes storage).
- Live Migration: Running containers seamlessly migrate across physical hosts (including interruptible Spot nodes) while preserving RAM state and active TCP connections.
- Direct VPC Networking: Every container receives a dedicated private IP address within an isolated private network with line-rate eBPF routing.
[!NOTE] microsrv containers combine the instant startup and density of OCI images with the reliability, disk persistence, and live migration of classic VMs.
Sandbox Architecture
Secure workload execution is powered by a high-security sandbox runtime based on gVisor (runsc):
1. SYSCALL INTERCEPTION IN USER-SPACE
[SYSCALLS] App issues syscalls (read, write, fork, socket) • Sentry emulates Linux kernel logic entirely in user-space
Core Subsystems:
- Sentry: A complete user-space Linux kernel written in Go. Sentry emulates over 300 Linux system calls, preventing untrusted guest code from directly interacting with the host kernel.
- Gofer: An isolated filesystem proxy process mediating I/O operations and persisting file mutations to storage volumes.
- Netstack: A user-space network stack delivering isolated packet processing and direct integration with VPC network interfaces.
Comparison: Kubernetes vs microsrv Containers vs VMs
| Feature | Standard Kubernetes / Docker | microsrv Containers | microsrv VMs (KVM) |
|---|---|---|---|
| Kernel Isolation | Shared host kernel (privilege escalation risk) | Sentry Sandbox (User-space Linux kernel) | Hardware virtualization (KVM) |
| Root Filesystem | Ephemeral (wiped on pod restart or reschedule) | Stateful OverlayFS (persisted on replicated NVMe) | Dedicated NVMe block volume |
| Live Migration | ❌ Not supported (pod eviction + cold restart) | ✅ Supported (RAM pre-copy + TCP socket handover) | ✅ Supported (KVM RAM pre-copy + eBPF) |
| TCP Session Preservation | ❌ Sockets reset on reschedule | ✅ Active TCP connections stay open | ✅ Active TCP connections stay open |
| Networking | Overlay CNI (Flannel/Calico) with host NAT | Direct VPC network interface with dedicated private IP | Direct VPC network interface with dedicated private IP |
| Startup Latency | < 1 second | ~1–2 seconds | 5–10 seconds |
| Memory Overhead | Minimal | Low (~30–50 MB per Sentry sandbox) | Moderate (guest OS kernel image) |
Primary Use Cases
- Stateful Web Apps & APIs: Running services that require persistent local configurations, files, or embedded databases (SQLite, DuckDB, RocksDB) without complex CSI storage setups.
- Zero-Downtime Spot Compute: Deploying workloads on low-cost interruptible servers at up to 25% savings, backed by automated live migration during host reclamation.
- Secure Untrusted Code Execution: Executing user scripts, CI runners, and agent environments inside strongly isolated sandboxes.