Replit rebuilt its sandbox engine with microVMs

clhodapp

It's only somewhat related to the article, but: How do people feel about the hardware isolation provided by microVMs versus strong software isolation techniques like gvisor? Right now, we put a huge amount of stock in "hardware isolation". If that starts falling to agents to any substantial degree, I wonder whether we might end up seeing a transition toward patchable software isolation, similar to the rise of software RAID that occurred a while back.

stevekemp

I do hope nobody reading this copies any of Replit's design decisions or architecture, lest they get threatened. I avoided reading the piece, just in case.

pearcoder

MicroVMs are quite popular nowadays due to sandboxing but we need to also keep in mind least privilege principle. Applying that is also tricky.

curiousgal

This Replit? https://intuitiveexplanations.com/tech/replit/

ghshephard

Replit intrigues me. Other than Paul Graham talking it up a lot on Twitter - I've never once heard of anyone using it, seen any chatter about it in any or our internal slack forums. Every other AI company I get barraged with- no matter where I go, even antigravity/gemini carbon/argon/models/etc... - which nobody I know uses either - but at least I hear about them a lot. I wonder what ecosystem replit exists in that seems to completely not overlap with any of the other AI technologies and companies....

schainks

My read on this is they re-invented the OTP supervision tree, process isolation, hibernation, and actor-to-actor message passing, but had to push the isolation boundary all the way down into Ring -1 (KVM/Cloud Hypervisor) and customized Linux tinyconfig kernels because their "actors" are actively trying to jailbreak the hypervisor. Is that about right?

iberator

Guys. You could do the same with ansible like decade ago.

vivzkestrel

stupid question: why dont you use docker sbx