microVM monitors are minimal virtual machine monitors built for fast, dense, isolated workloads, especially serverless and sandboxed containers. Firecracker and Cloud Hypervisor expose only a handful of virtio devices and a thin API, which shrinks the guest-to-host escape surface compared to full QEMU, but the remaining device models and the management API are still attackable. These monitors also back sandboxed container runtimes.
Subtopics#
- Firecracker: the AWS microVM monitor.
- Cloud Hypervisor: the Rust VMM.