Hacker News: eperot

New comment by eperot in "Reduce GVisor Cold Starts with GPU Snapshotting"

eperot — Wed, 01 Jul 2026 18:30:08 +0000

gVisor is open-source, and `cuda-checkpoint` is freely available.

gVisor's `runsc checkpoint` subcommand supports a `--save-restore-exec-argv` which lets you specify a program to execute before gVisor starts taking the process snapshot.

You can fill in the blanks from there.

New comment by eperot in "Reduce GVisor Cold Starts with GPU Snapshotting"

eperot — Wed, 01 Jul 2026 18:26:57 +0000

Wrong headline order, right? Should read "Reduce GPU Cold Starts with gVisor Snapshotting".

New comment by eperot in "MicroVMs: Run isolated sandboxes with full lifecycle control"

eperot — Mon, 29 Jun 2026 23:07:25 +0000

Ah, I see the distinction. In my case, I was using the PulseAudio client+server with a network sink running in-sandbox, producing a set of audio samples that are then replayed by a PulseAudio client in the out-of-sandbox Rust application receiving these samples. Exposing the socket directly to the sandbox is dangerous, e.g. it would let the sandbox record the host's microphone directly.

My goal was for the sandbox to only have access to a single dumb playback sink and no other access by default, and to gate any further access (e.g. microphone access) in something the out-of-sandbox software can catch and ask the user about before it is granted to the sandbox.

New comment by eperot in "MicroVMs: Run isolated sandboxes with full lifecycle control"

eperot — Sat, 27 Jun 2026 00:11:50 +0000

That's the approach I initially took, but experienced some combination of noticeable stuttering and latency regardless of which buffering strategy I tried... Had to switch to a shared memory ring buffer, along with some adaptive playback speed shenanigans (sometimes imperceptibly speeding up playback when falling behind production of audio samples, sometimes imperceptibly slowing down when there's less than a few milliseconds' worth of samples left in the ringbuffer), in order to achieve actually-gapless playback.

New comment by eperot in "MicroVMs: Run isolated sandboxes with full lifecycle control"

eperot — Fri, 26 Jun 2026 22:41:00 +0000

Thanks. We're working on rootless network setup to make `runsc do --rootless` work with networking enabled when `passt` is installed right now. See issue #13337 (yes that's a cool issue number) which should unblock this.

The tty issue is known, should be fixed soon too, though contributions welcome as it sounds like it should be simple fix and we love more contributions :)

FWIW, X11 apps work well, I have a personal hacky project in which I've been running Librewolf in gVisor, with the window being reflected as a native Wayland window. It uses `Xvfb -fbdir` aimed at a bound tmpfs mount to get a shared memory region containing the window's pixel data which can be read directly from out of the sandbox, has Pulseaudio audio passthrough, and a socket server passing through mouse/keyboard events to make the window interactive. Works smoothly even for YouTube playback, and I successfully played a game of Unreal Tournament 2004 at 24fps in it, with no noticeable mouse/keyboard latency :) We're basically making baby steps to get there less hackily.

Thanks for the feedback!

New comment by eperot in "MicroVMs: Run isolated sandboxes with full lifecycle control"

eperot — Fri, 26 Jun 2026 21:23:12 +0000

Any reason why you wouldn't use gVisor's bwrap interface yet? We're working on it precisely to make DIY sandboxing on Linux as easy as possible in order to get Linux-sandboxing-at-home to mature beyond the current syscall-filter-and-namespaces duct tape stage, so I'm curious to know what you'd like to see.

New comment by eperot in "Magi: Multi-Agent GVisor Isolation"

eperot — Wed, 15 Apr 2026 21:29:54 +0000

An overkill fully-local multi-agent setup with gVisor sandboxing. Hope some folks here can appreciate the Evangelion vibes :)

Magi: Multi-Agent GVisor Isolation

eperot — Wed, 15 Apr 2026 21:29:08 +0000

Article URL: https://gvisor.dev/blog/2026/04/15/magi-multi-agent-gvisor-isolation/

Comments URL: https://news.ycombinator.com/item?id=47785501

Points: 7

# Comments: 1

New comment by eperot in "Computer use, a new Claude 3.5 Sonnet, and Claude 3.5 Haiku"

eperot — Thu, 24 Oct 2024 02:42:18 +0000

I have been [working on one](https://github.com/EtiennePerot/safe-code-execution)! The library is in [src/safecode/sandbox.py](https://github.com/EtiennePerot/safe-code-execution/blob/mas...).