staring at a wall is basically the zen practice of shikantaza [1], except you’re not staring, it’s more of an eyes half closed yet alert gaze. you don’t do anything, not even counting the breath. you just sit, that’s the entire practice. in my experience, the more you intellectualize it, the more difficult it becomes!
honest question: what use case requires cold starts below 100ms, considering TTFT of major LLMs are in the 300+ms range? presumably sandbox will be driven by an agentic loop, so.. you’re still bottlenecked by what essentially amounts to network I/O.
I don't get it. You mention being able to choose your own JS engine, so it's not using Wasmer's WebAssembly implementation but that of the chosen JS engine's? In other words, can Edge.js use Wasmer? Or have you managed to compile V8/JSC into WebAssembly and are executing it with Wasmer? If so, amazing!
When you have a hammer, everything looks like a nail. Ad nauseam.
AI has made it possible for me to build several one-off personal tools in the matter of a couple of hours and has improved my non-tech life as a result. Before, I wouldn't even have considered such small projects because of the effort needed. It's been relieving not to have to even look at code, assuming you can describe your needs in a good prompt. On the other hand, I've seen vibe coded codebases with excessive layers of abstraction and performance issues that came from a possibly lax engineering culture of not doing enough design work upfront before jumping into implementation. It's a classic mistake, that is amplified by AI.
Yes, average code itself has become cheap, but good code still costs, and amazing code, well, you might still have an edge there for now, but eventually, accept that you will have to move up the abstraction stack to remain valuable when pitted against an AI.
What does this mean? Focus on core software engineering principles, design patterns, and understanding what computer is doing at a low level. Just because you're writing TypeScript doesn't mean you shouldn't know what's happening at the CPU level.
I predict the rise in AI slop cleanup consultancies, but they'll be competing with smarter AIs who will clean up after themselves.
https://amirmalik.net - I haven't blogged in a while, but have been experimenting with single-file build-step-free HTML tools (inspired by simonw's tool catalog) at https://amirmalik.net/tools -- I'm hoping to add more "bring your own API key" local-first mini tools that store their data in IndexedDB or OPFS and sync. I should probably write a post about it :)
I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor).
While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot the VM and save it as a "template". Then for every request, the snapshot was cloned (with some file system tricks like CoW) and resumed to handle the request. It "just" worked, but the orchestration was kludgy.
In the second incarnation of this, I decided to use Linux containers with the gVisor sandbox. You can take a look at my project https://github.com/ammmir/sandboxer which uses Podman and gVisor underneath; it's good enough for a prototype. Later on, you can swap it out with Firecracker microVM, if necessary. In fact, I'm thinking of adding microVM support to sandboxer itself. If you wanted to do it yourself, swap out ContainerEngine() with a new implementation based on calling out to Firecracker. You'll need some way to do disk volume management (grow, clone, shared, cross-machine? good luck!), snapshots, etc.
SEEKING WORK | Bangkok, Thailand | REMOTE (APAC timezone)
Hi, I'm a seasoned software professional with 15+ years of experience across the stack, from low-level systems and protocols to web and mobile apps to DevOps CI/CD pipeline engineering to modern AI/LLM/agentic workflows. I like solving real business problems using stable and proven tools, as well as prototyping ideas, so whether you're looking to build a v1 of your product, a DevOps engineer, or looking for a CTO for a more established org, please reach out!
Hey HN! I'm a seasoned software professional with 15+ years of experience across the stack, from low-
level systems and protocols to web and mobile apps to modern AI/LLM/agentic workflows. I like solving real business problems using stable and proven tools, as well as prototyping ideas, so whether you're looking to build a v1 of your product or looking for a CTO for a more established org, please reach out!
I was using Zed up until a few months ago. I got fed up with the entire AI panel being an editable area, so sometimes I ended up clobbering it. I switched to Cursor, but now I don't "trust" the the editor and its undo stack, I've lost code as a result of it, particularly when you're in mid-review of an agentic edit, but decide to edit the edit. The undo/redo gets difficult to track, I wish there was some heirarchical tree view of history.
The restore checkpoint/redo is too linear for my lizard brain. Am I wrong to want a tree-based agentic IDE? Why has nobody built it?
Two months ago, I started exploring how LLMs can securely run arbitrary code. Since then, we've seen Manus and others build code inside sandboxes and I believe there are some YC startups in this space, too! I wrote a blog post [1] about building a simplistic version of this using Jupyter Notebook, but since then I've built a fully open source sandboxing server with more ergonomic HTTP endpoints (MCP should be next I guess?) and a half-decent UI for humans (see the demo video in the README).
A novel concept that I haven't seen implemented properly yet, perhaps useful for AI coding agents, is that a sandbox can be forked at any point. Similar to how you can fork a PostgreSQL database, you can fork a sandbox, which creates an independent sandbox with all of the changes in it. Technically, I tried to implement this with checkpoint/restore using CRIU, but ran into some issues with nesting beyond 2 levels deep and custom user namespaces for security. And it was difficult to use get CRIU to work with Linux programs that use shared memory segments, and other Unixy things. I ended up switching to file system diffs and using reflinks on XFS to get some Copy-on-Write semantics.
Features:
* Automatic HTTPS with unique URL per sandbox (no need to deal with ingresses or exposing ports)
* Static token auth or GitHub app auth
* Built-in UI
* Multi-tenant ready: each user gets their own network
* List, download, and upload files into sandboxes
* Fork sandboxes to create arbitrary depths of clones
It's still in early stages, but it should be usable. I'd love your feedback and ideas on where to take this :) Personally, I want to use this as a code execution backend for local AI agents.
Hey HN! I'm a seasoned software professional with 15+ years of experience across the stack, from low-level systems and protocols to web and mobile apps to modern AI/LLM/agentic workflows. I like solving real business problems using the latest tools, without introducing too many shiny new toys.
I'm looking for short-term consulting gigs (open to long-term), so whether you're looking to prototype something new in order to catch the AI hype train, or something more traditional, please reach out ASAP!
Last month, I started playing around with code sandboxes and how LLMs might interface with them and wrote a little blog post about it [1]. I then took the code and vibe coded my way to a multi-tenant (untested!) sandboxing server that lets you run arbitrary Docker containers and provides a simple HTTP interface and UI. A cute, novel idea is that you can fork containers easily, as seen in the video in my repo:
It may not be useful, but it's been fun, and I've honed my gut-level experience in Docker, Podman, Linux namespaces, Checkpoint/Restore, CRIU, and more. The ultimate goal is to hand each AI agent iteration a sandbox of its own (forked from the previous iteration), and have it build apps in private sandboxes. You'll be able to view intermediate progress as the app is being built (or failed rabbit holes), since each sandbox gets a unique URL automatically. Like, imagine if each commit of your git repo had its own URL to preview the app!
Yeah, I always thought MCP was a bit verbose. It reminds me of the WSDL and SOAP mess of the 2000s. Model tool calls are just RPCs into some other service, so JSON-RPC makes sense. Is there anything else has wide adoption and good client support? XML-RPC? gRPC? Protobufs? I mean, it shouldn't need extra libraries to use. You can handroll a JSON-RPC request/response pretty easily from any programming language.
Regarding the verbosity, yeah, it's interesting how model providers make more money from more tokens used, and you/we end up paying for it somehow. When you're doing lots of tool calls, it adds up!
This new cat and mouse game is perhaps a sign of the times...