5x faster Edge Functions: V8 isolates to Firecracker MicroVMs
Netlify rebuilt its edge functions infrastructure to run on Firecracker MicroVMs instead of external V8 isolates, reducing median warm invocation latency from 25–40ms down to 5–6ms.
read it It provides a detailed architectural breakdown of how Netlify integrated Firecracker MicroVMs and Unikraft to dramatically cut edge function latency and improve isolation.
summary
Netlify migrated its Edge Functions infrastructure from external third-party V8 isolate services to Firecracker MicroVMs hosted directly within its own edge network in collaboration with Unikraft. By utilizing memory-mapped EROFS images, microVM snapshots, and rendezvous hashing, they achieved a median warm invocation latency of 5–6ms, down from 25–40ms. This shift provides true hardware-level isolation, removes previous limits on npm packages, and enables higher operational flexibility.
key points
- Warm invocation latency dropped from 25-40ms down to 5-6ms at the median, with p99 invocations improving by 47.4%.
- MicroVMs use uncompressed EROFS images that are memory-mapped, allowing instances to boot, snapshot, and restore in milliseconds while scaling to zero when idle.
- The architecture provides hardware-level isolation compared to shared-kernel V8 isolates, enabling full Node.js built-ins and robust npm package support without security cross-contamination risks.
who should read it
Infrastructure engineers and backend developers interested in serverless compute architectures, virtualization, and edge computing performance optimization.
discussion warm
consensus
Commenters noted that Netlify's previous latency figures were high because their old V8 isolates ran over the internet rather than natively at the edge like competitors. There is broad agreement that Firecracker MicroVMs provide superior security and hardware-level isolation compared to shared-kernel V8 isolates.
pushback
Some commenters raised concerns about the hidden risks of forked RNG states and security vulnerabilities when restoring microVMs from pre-boot snapshots.
> When the MicroVM boots up and the JavaScript server begins to listen on a port, we take a snapshot of the MicroVM. [...] we start a new MicroVM from that snapshot.
That sounds scary, since forked RNG states can lead to catastrophic failures in UUID generators or cryptography.
It highlights the critical risk of forked RNG states when booting microVMs from snapshots, citing historical vulnerabilities in similar serverless architectures.
Generated by an LLM from the article and thread. Check the sources before relying on it.