Containers Overview
Sandboxed containers featuring live migration, Stateful OverlayFS, and native VPC integration.
What are Containers in microsrv?
The microsrv platform enables you to run OCI-compliant containers within strongly isolated, secure sandboxes.
Unlike standard container runtimes (Docker, containerd, Kubernetes) where containers share the host Linux kernel and rely on volatile filesystems, microsrv containers provide the persistence and resilience of dedicated virtual machines:
- Serverless & Scale-from-Zero: Containers automatically pause during idle periods and wake up in seconds upon the first incoming TCP packet. Billing applies strictly to active processing time.
- Kernel-level isolation without hypervisor overhead: Application system calls are intercepted and handled in user-space by the Sentry sandbox kernel.
- Persistent Storage (Stateful OverlayFS): Root filesystem modifications are persisted directly onto a replicated NVMe volume, surviving restarts and host rescheduling (unlike ephemeral Kubernetes storage).
- Live Migration: Running containers seamlessly migrate across bare metal host hypervisors (including interruptible hosts) while preserving RAM state and active TCP connections.
- Direct VPC Networking: Every container receives a dedicated private IP address within an isolated private network with line-rate eBPF routing.
[!NOTE] microsrv containers combine the instant startup and density of OCI images with serverless economics, disk persistence, and bare metal host reliability.
Sandbox Architecture
Secure workload execution is powered by a high-security sandbox runtime based on gVisor (runsc):
1. SYSCALL INTERCEPTION IN USER-SPACE
[SYSCALLS] App issues syscalls (read, write, fork, socket) • Sentry emulates Linux kernel logic entirely in user-space
Core Subsystems:
- Sentry: A complete user-space Linux kernel written in Go. Sentry emulates over 300 Linux system calls, preventing untrusted guest code from directly interacting with the host kernel.
- Gofer: An isolated filesystem proxy process mediating I/O operations and persisting file mutations to storage volumes.
- Netstack: A user-space network stack delivering isolated packet processing and direct integration with VPC network interfaces.
Comparison: Kubernetes vs microsrv Containers vs VMs
| Feature | Standard Kubernetes / Docker | microsrv Containers | microsrv VMs (KVM) |
|---|---|---|---|
| Scale-from-zero / Serverless | ❌ Complex add-ons required (Knative, KEDA) | ✅ Out of the box (on incoming TCP packet) | ✅ Out of the box (on incoming TCP packet) |
| Kernel Isolation | Shared host kernel (privilege escalation risk) | Sentry Sandbox (User-space Linux kernel) | Hardware virtualization (KVM) |
| Root Filesystem | Ephemeral (wiped on pod restart or reschedule) | Stateful OverlayFS (persisted on replicated NVMe) | Dedicated NVMe block volume |
| Live Migration | ❌ Not supported (pod eviction + cold restart) | ✅ Supported (RAM pre-copy + TCP socket handover) | ✅ Supported (KVM RAM pre-copy + eBPF) |
| TCP Session Preservation | ❌ Sockets reset on reschedule | ✅ Active TCP connections stay open | ✅ Active TCP connections stay open |
| Networking | Overlay CNI (Flannel/Calico) with host NAT | Direct VPC network interface with dedicated private IP | Direct VPC network interface with dedicated private IP |
| Startup Latency | < 1 second | ~1–2 seconds | 5–10 seconds |
| Memory Overhead | Minimal | Low (~30–50 MB per Sentry sandbox) | Moderate (guest OS kernel image) |
Primary Use Cases
- Serverless Workloads & Idle Cost Optimization: Web APIs, background bots, and webhook consumers that sleep when inactive, reducing compute bills by up to 85%.
- Stateful Web Apps & APIs: Running services that require persistent local configurations, files, or embedded databases (SQLite, DuckDB, RocksDB) without complex CSI storage setups.
- Zero-Downtime Interruptible Compute: Deploying workloads on low-cost interruptible bare metal servers at up to 25% savings, backed by automated live migration during host reclamation.
- Secure Untrusted Code Execution: Executing user scripts, CI runners, and agent environments inside strongly isolated sandboxes.