MicroVMs are quite popular nowadays due to sandboxing but we need to also keep in mind least privilege principle. Applying that is also tricky.

It's only somewhat related to the article, but:

How do people feel about the hardware isolation provided by microVMs versus strong software isolation techniques like gvisor?

Right now, we put a huge amount of stock in "hardware isolation". If that starts falling to agents to any substantial degree, I wonder whether we might end up seeing a transition toward patchable software isolation, similar to the rise of software RAID that occurred a while back.

Show 1 reply

I do hope nobody reading this copies any of Replit's design decisions or architecture, lest they get threatened.

I avoided reading the piece, just in case.