Hacker News Reader

Comment by lovingCranberry | Hacker News Reader

I was recently looking into an equivalent for V8 isolates. I'd like something like this for python, but it looks like micro VMs is my best bet here. For anyone working in this field or having hands-on experience: is weave's ignite a choice if I'd want to execute long-running python scripts of users? I remember that there was a lot of overhead for I/O. Or should I just go with raw Firecracker like Stan does in this article?

The scripts would be long-running, but don't require much computational power. Just a few arithmetic operations on an array every second. The array is being fed in via WebSocket.

View on HN

Weave is probably overkill. Firecracker or gVisor are where I'd start.

Using Firecracker directly is pretty straightforward: https://jvns.ca/blog/2021/01/23/firecracker--start-a-vm-in-l...

gVisor gives you all the container tooling, which may or may not be useful.

And, because I'm a shill, we actually shipped an API specifically for this kind of use case. So if you'd rather not build it all yourself, we can help: https://fly.io/blog/fly-machines/

I'm a fan of Firecracker, but your use case might be a better fit for plain old containers because the tooling is currently more mature. If it's the isolation that attracts you to Firecracker, gVisor is an option: https://gvisor.dev/.

The isolation is the main pin point why I was looking at firecracker.

Thank you for linking gVisor, went through the docs real quick and it looks very promising for my use case.

For the open-source windmill project, we need to support sandboxing of typescript (deno) and python. For deno we could have just relied on v8 isolate and deno layer of isolation. But for Python we could not anyway so we had to come up with a common solution. We chose nsjail in the end and it works really well. All the config files are here: https://github.com/windmill-labs/windmill/tree/main/nsjail and this is how it is spawned from within the Rust worker: https://github.com/windmill-labs/windmill/blob/main/backend/...

Happy to expand more of my experience of making this work at scale.

Related discussion from this past Saturday:

https://news.ycombinator.com/item?id=32289979 (70 points, 16 comments)

and

https://news.ycombinator.com/item?id=32287798

Both links include hot takes from a tech lead for CF Workers (@kentonv).

If you take a look at the Skybison Python runtime, I would be happy to chat and help you poke around integrating it: https://github.com/tekknolagi/skybison

You want to run short lived Python in a trusted environment? Can you go into more detail about your specific use case? How much CPU, memory and IO do you need to do? Is it chatty over the life of the execution or does have all of its data up front?

Cloudflare will be opening their V8 isolate runtime soon (for Cloudflare Workers)

Can you expand on this (a relevant link will suffice)?

https://blog.cloudflare.com/workers-open-source-announcement...

https://twitter.com/KentonVarda/status/1523666343412654081

Any approximate ETA?

“a couple months out”

Reply on news.ycombinator.com