aws·Jun 22, 2026·3 min readCurated summary

Run isolated sandboxes with full lifecycle control: AWS Lambda introduces MicroVMs | Amazon Web Services

AWS Lambda MicroVMs provide isolated, stateful execution environments for running untrusted user- or AI-generated code without managing virtual machine infrastructure. Built on Firecracker, they combine VM-level isolation, near-instant startup and resume, and persistent memory and disk state. The post concludes that MicroVMs fill the gap between slow, isolated VMs, less-secure containers, and stateless event-driven Lambda functions. ## The Need for Isolated, Stateful Execution - AI coding assistants, online development environments, analytics tools, vulnerability scanners, and game servers increasingly need a dedicated environment for each user or session. - Traditional options involve tradeoffs: - VMs provide strong isolation but often take minutes to start. - Containers launch quickly but share a kernel and require extensive hardening for untrusted workloads. - Standard serverless functions are designed for short, request-response workloads rather than long-running interactive sessions. - Building custom virtualization infrastructure requires significant security, operations, and virtualization expertise. ## What Lambda MicroVMs Provide - Each user or session receives its own Firecracker-powered MicroVM. - MicroVMs offer: - Dedicated VM-level isolation with no shared kernel between users. - Rapid launch and resume from a pre-initialized snapshot. - Persistent memory, disk state, and running processes during a session. - Automatic suspension during inactivity to reduce idle costs. - Automatic resume when new traffic arrives. - Firecracker already powers AWS Lambda at large scale, providing an established virtualization foundation. ## Creating a MicroVM Image - The example packages a Flask application and Dockerfile into a ZIP archive and uploads it to Amazon S3. - The Dockerfile uses: ```dockerfile FROM public.ecr.aws/lambda/microvms:al2023-minimal ``` - It installs Python and dependencies, copies the Flask application, and starts it with Gunicorn on port 5000. - An image is created with the `aws lambda-microvms create-microvm-image` command, specifying: - The S3 code artifact - An image name - An AWS-provided base image ARN - An IAM build role - Lambda builds the image, initializes the application, and captures its memory and disk state in a Firecracker snapshot. - Build logs are available in CloudWatch under `/aws/lambda/microvms/<image-name>`. ## Launching and Managing a MicroVM - A MicroVM is launched from the image ARN with `run-microvm`. - The example configures an idle policy that: - Suspends the MicroVM after 15 minutes of inactivity. - Keeps it suspended for up to 5 minutes. - Automatically resumes it when traffic returns. - Lambda assigns a unique MicroVM ID and provides a dedicated HTTPS endpoint. - No separate networking setup is required. - The application is already running when the MicroVM becomes available because it resumes from the image snapshot. ## Request Handling and State Preservation - Clients authenticate requests using a short-lived token in the `X-aws-proxy-auth` header. - The Flask API responds immediately after launch. - When the MicroVM becomes idle, Lambda snapshots and stores its memory and disk state. - A later request resumes the environment with the application state intact, making suspension effectively invisible to the client. ## Underlying Execution Model - Lambda MicroVMs use an image-then-launch workflow: - Build and initialize an environment once. - Snapshot the initialized state. - Launch future MicroVMs by resuming that snapshot. - This avoids repeating operating-system and application startup work. - The combination of Firecracker isolation, snapshot-based startup, and suspend/resume lifecycle control makes MicroVMs suitable for secure, interactive, multi-tenant workloads. For applications that must safely execute untrusted code while preserving session state and responsive startup times, Lambda MicroVMs offer a managed alternative to building custom VM infrastructure.

Read original(opens in new tab)

FlaskPythonDocker & ContainersAmazon S3+3

gitlab·Mar 26, 2026·3 min readCurated summary

Getting started with GitLab feature flags in Python

GitLab feature flags let teams deploy code without immediately exposing it to users, reducing the risk of production failures and eliminating redeployments for rollbacks. Using the Unleash Python SDK, a Flask application can retrieve flag definitions from GitLab, cache them locally, and evaluate them quickly without a network request on every check. The tutorial demonstrates a practical setup using configurable rollout strategies such as user targeting, percentage rollouts, and all-user releases. ## Requirements and Project Setup - A GitLab project with Feature Flags enabled under **Settings > General > Visibility, project features, permissions**. - A fork or clone of the demo repository: - `app.py` contains the Flask and Unleash integration. - `requirements.txt` lists dependencies. - `.env.example` documents required configuration. - `templates/index.html` and `static/styles.css` provide the demo interface. - The example repository is available at `gitlab.com/omid-blogs/gitlab-feature-flags-demo`. ## How the Unleash Integration Works - GitLab provides an Unleash-compatible API for each project, so no separate Unleash server is required. - The SDK downloads flag definitions when the application starts. - It refreshes the cached configuration periodically; the demo uses a 15-second interval. - Calls to `is_enabled()` evaluate flags locally, avoiding a network request for each check. - Local evaluation makes flag checks fast and more resilient to temporary connectivity problems. ## Creating Feature Flags The tutorial creates four active flags, initially using the **All users** strategy: - `dark_mode` enables a dark color scheme. - `holiday_banner` displays a festive banner. - `new_layout` changes the card grid to a single-column layout. - `fun_fonts` applies a playful handwritten font. A flag must be both **Active** and assigned at least one strategy. An active flag without a strategy is evaluated as disabled. ## Choosing Rollout Strategies GitLab supports several built-in strategies: - **Percent rollout:** Gradually enables a feature based on user ID, session ID, or random assignment. - **Percent of users:** Targets a percentage of authenticated users. - **User IDs:** Limits access to explicitly named users, useful for QA. - **User list:** Enables a feature for a predefined user group. - **All users:** Enables the feature for everyone. A typical release process is to begin with QA users, move to a 10% rollout, and eventually enable the feature for all users entirely through GitLab’s UI. ## Configuring Unleash Credentials From the project’s Feature Flags page, the **Configure** panel provides: - `UNLEASH_URL`, such as `https://gitlab.com/api/v4/feature_flags/unleash/<your-project-id>` - `UNLEASH_INSTANCE_ID`, a project-scoped read-only token - `UNLEASH_APP_NAME`, used to identify the application, for example `production` The Instance ID can read flag state but cannot modify flags. It should still be treated as a secret because it can expose project flag information. ## Running the Application Locally - Install dependencies with: ```bash pip install -r requirements.txt ``` - Copy `.env.example` to `.env` and replace the placeholders with the GitLab credentials. - Export the variables from the `.env` file or define them directly in the terminal. - The three environment variables driving the integration are: - `UNLEASH_URL` - `UNLEASH_INSTANCE_ID` - `UNLEASH_APP_NAME` - Never commit `.env`; the repository’s `.gitignore` excludes it because the Instance ID is sensitive. The recommended approach is to use the `UnleashClient` Python SDK to handle polling, caching, and local feature-flag evaluation, while GitLab remains the control center for changing rollout behavior.

Read original(opens in new tab)

FlaskGitlabPythonApi Integration+4

datadog·Jun 6, 2022·3 min readCurated summary

Engineering Spotlight: Tay Nishimura

Tay Nishimura’s career shows that succeeding in tech is often less about fitting a standard engineering mold and more about finding work that matches one’s strengths. Although she initially struggled with the speed and coding demands of software development, her rigor, visual thinking, and careful approach became valuable in site reliability engineering. Her transition was enabled by self-directed learning, community education, and ToyNet, an open source networking simulator that demonstrated her practical abilities. ## Entering Tech from Mathematics - Tay began as a mathematics major focused on real analysis, then added computer science after advice from a professor. - Internships at Amazon and Google introduced her to the technology industry. - She found a sharp contrast between academia and industry: - School rewarded theoretical rigor. - Industry emphasized practical, fast, and agile solutions. - Tay also felt like an outsider because she had little exposure to computers growing up. ## Struggling with Traditional Software Engineering - Coding did not come naturally to Tay’s visual way of thinking. - She translated code into drawings to understand and modify it, then converted those ideas back into code. - This process produced high-quality, careful work but made her slower than colleagues expected. - A manager suggested product management and site reliability engineering as possible alternatives. - Tay discovered that her deliberate pace was useful for SRE work, particularly when evaluating failure modes and making critical changes. - Because her company offered no path into those roles, she eventually left rather than continue facing increasing stress. ## Discovering Networking and Technical Program Work - Tay’s next role had a software engineer title but involved work closer to product or technical program management. - She learned that job titles and responsibilities vary significantly between companies. - With better work-life balance, she began studying computer networking in her free time. - She created visual diagrams and learning modules to explain switches, routers, and packet flows. - These efforts became Project Reclass, a nonprofit teaching technical skills to incarcerated people and military veterans. - The program used improvised equipment, such as fake routers and switches, to teach concepts in environments where real networking hardware was unavailable. ## Building ToyNet During the Pandemic - After her company laid off its entire office during COVID-19, Tay decided to pursue SRE directly. - When prisons suspended in-person education, Project Reclass adapted by creating a digital networking simulator. - Tay architected ToyNet, an open source platform built with: - React - A Flask backend - Containerized Mininet instances for network emulation - Users can connect simulated routers, switches, and hosts, configure IP addresses, and run commands such as `ping` and `arp`. - ToyNet was designed to work for incarcerated learners with restricted internet access. - Deploying it in the cloud also gave Tay practical experience that helped compensate for limited professional cloud experience. - Companies interested in the project were more likely to advance her through the interview process, eventually leading to Datadog. ## Finding the Right Environment at Datadog - At Datadog, Tay learned Kubernetes, chaos engineering, network traffic control, and Go. - She found that her rigor and visual thinking were assets rather than liabilities. - While learning Datadog’s Chaos Controller codebase, she mapped files and dependencies by drawing boxes and arrows. - Her experience suggests that engineers do not need to learn or reason in a single conventional way; the right environment can turn an apparent weakness into a strength. Tay’s path recommends experimenting broadly, studying independently, and building concrete projects that reveal how you think and solve problems. The most suitable tech role may emerge only after moving between companies and disciplines rather than forcing yourself to succeed in an ill-fitting position.

Read original(opens in new tab)

FlaskKubernetesOpen SourceReact+4