Last month we measured what a KVM guest pays on the paths inside a kernel. This time we gave both a network card. We booted the same kernel twice on...
Latest Insights
Stay updated with the latest developments in multikernel technology, cloud computing, and operating system innovation.
A task that finishes its work in 56 milliseconds on an idle machine watched its median hit 824 milliseconds and its p99 hit 35.6 seconds, on its own dedicated cores,...
We measured anonymous page fault throughput with will-it-scale on a 128-core ARM server that exposes four NUMA nodes in a single socket. Within a 32-core node, throughput saturates at roughly...
We pointed will-it-scale at a 48-core Xeon and watched a single Linux kernel bend under its own locks: unlink throughput at 48 cores is 40% of what one core delivers...
We booted the same kernel twice on one machine: once as a multikernel instance on dedicated cores, once as a KVM guest with every hardware assist enabled (EPT, APICv, IPI...
RISC-V server silicon now ships cores with different vector widths on the same die, and it just killed the oldest promise in operating systems: that any task can run on...
Our first design spliced two co-located TCP sockets with a single user-to-user copy, the theoretical minimum for an unmodified sockets API. It was elegant, and it was the wrong tradeoff....
The industry is spending millions on microVMs and container runtimes to sandbox AI agents. But the threat model is wrong. Agents are not adversaries. Isolation is not security. Most agents...
Sandlock introduces sandbox pipelines: chain sandboxed stages with the | operator, where each stage has its own Landlock and seccomp policy. Data flows through kernel pipe buffers the parent process...
Container-based agent sandboxes give every tool the same permissions. Sandlock now supports per-tool-call kernel-enforced isolation: each tool gets only the capabilities it declares. Deny by default, least privilege per call....
We benchmarked Sandlock against Docker using Redis 8.6 with 50 concurrent clients and 256-byte payloads. Sandlock delivered 141,000 ops/sec versus Docker's 113,000. Median latency: 0.33 ms versus 0.50 ms. Tail...
Sandlock introduces COW fork: initialize a sandbox once, then fork thousands of copy-on-write clones in microseconds. Each clone shares the template's memory pages until it writes. No containers, no CRIU,...
Containers and microVMs start from scratch. Processes start from a copy. We explain why fork() and copy-on-write memory are the right primitives for AI sandboxing, and introduce Sandlock, a lightweight...
Today we are open-sourcing Lazy CMA, a Linux kernel module that allocates physically contiguous memory at runtime without boot-time reservation, enabling flexible memory management for kdump, multikernel, and DAXFS workloads....
We are open-sourcing DAXFS, a disaggregated filesystem designed for multi-kernel and multi-host shared memory. Built on CAS-based lock-free coordination, DAXFS enables multiple kernel instances and CXL-connected hosts to share data...
We're excited to announce that Multikernel is officially open-sourcing our Linux kernel implementation, engaging with the Linux kernel community early in our process.