Atharva Pandey Gopherine

Zeroboot achieves sub-millisecond VM sandbox creation using copy-on-write forking.

The architecture decision: Zeroboot utilizes the copy-on-write (CoW) forking mechanism, where a child process is created by fork()ing an already-running VM snapshot, sharing the parent’s memory pages until either process writes, at which point the kernel copies just that page. This approach enables full isolation with near-zero startup cost. The use of CoW forking allows Zeroboot to create sandboxes at a rate of under a millisecond.

The tradeoff nobody talks about: The CoW forking approach is optimized for read-heavy workloads, but it can be defeated by write-intensive workloads. If an AI agent writes to many memory pages quickly, it can trigger a storm of page faults, each copying a 4KB page, thereby increasing the latency. For instance, an agent that allocates 100MB of heap on startup can lead to a significant number of page faults, rendering the CoW forking approach less effective.

The implementation detail: The Zeroboot implementation uses the libc library directly for fork semantics, rather than relying on a hypervisor layer. This design choice allows sandboxes to be created as Linux processes, sharing the host kernel, which results in faster sandbox creation. However, this approach also means that the isolation boundary is the process, rather than being hardware-enforced.

The engineering principle: This approach is similar to the pattern used in Redis BGSAVE, where the process is forked, and the child serializes the state while the parent continues serving. The use of CoW forking makes the fork nearly free, providing snapshot isolation at almost zero cost. If the workload is read-heavy with occasional writes, CoW forking can be an effective technique for achieving isolation.

https://github.com/zerobootdev/zeroboot

Most engineers pick one language and defend it to death. I use both — Go for services that need to ship fast, Rust for anything that touches memory or needs to run forever without supervision.

The real skill is not mastering one language. It is knowing when each one is the right tool.

Go gives you fast iteration, simple concurrency, and a binary you can deploy anywhere. Rust gives you zero-cost abstractions, memory safety without a GC, and the confidence that if it compiles, it works.

Stop picking sides. Start shipping.

The if err != nil pattern gets hate but it forces you to think about every failure mode at the call site. That is not boilerplate — that is engineering discipline.

Compare with try/catch where errors silently bubble up three layers before anyone notices.