Beyond Isolates: How MicroVMs are Redefining Edge Function Performance

The serverless and edge computing landscape is experiencing a significant shift, moving away from the traditional V8 isolate paradigm towards Firecracker microVMs. This change was made by Netlify, which resulted in a dramatic reduction in median warm latency from 25-40 ms to 5-6 ms. This transition might seem counterintuitive, as isolates are typically seen as lightweight, high-performance options while virtual machines are considered heavy and slow.

To understand the performance gains, it is essential to examine the architecture and what happens under the hood when a request hits the edge. The performance benefits are not solely attributed to the runtime but also involve eliminating unnecessary network hops and optimizing microVM lifecycles.

A V8 isolate functions as a discrete heap and execution context within a single process, enabling rapid startup times. However, this speed advantage comes with weaker isolation, as there is no dedicated kernel or separate process for each tenant. As deployment scales increase, the risk surface area grows, making hardware-backed isolation a necessary compromise.

Netlify's transition highlights the importance of balancing speed and isolation, particularly in high-volume traffic scenarios. By moving compute nodes directly into the edge network, the system eliminates round-trip latency and reduces the latency floor from 25-40 ms to 5-6 ms. This unified pipeline consists of edge nodes handling TLS termination and request routing, compute nodes managing microVM lifecycle and caching function images, and a centralized control plane for orchestration.

Key performance secrets of microVMs include snapshots and memory mapping. Snapshots enable instantaneous restoration, bypassing traditional cold boots and significantly reducing response times to single-digit milliseconds. Memory-mapped images allow the function code to be bundled as an uncompressed EROFS image, with the guest VM only reading the required pages of code, thereby avoiding memory loading overhead.

The lifecycle of a snapshotted VM involves capturing the state—including memory contents and emulated device states—and storing it as a snapshot. When a microVM goes idle, the platform saves this snapshot, allowing subsequent requests to be served by restoring from these snapshots, thereby avoiding the OS boot sequence.

To ensure uniqueness and maintain security invariants, systems employ technologies like VMGenID to handle unique values like random tokens or identifiers upon VM restoration. Routing and sticky compute nodes further optimize performance through rendezvous hashing, assigning specific functions to specific nodes, and ensuring frequently used functions have their images and snapshots primed in memory.

However, the system employs an elastic routing strategy to mitigate potential hotspots, spreading the load across a broader pool of nodes if traffic patterns exceed predefined thresholds. This approach results in only about 1.2 percent of invocations experiencing cold starts, demonstrating the effectiveness of this routing strategy.