← gary bécigneul

Series

Notes on building k7d

Notes from building k7d, a Rust VMM that forks a live Kubernetes cluster in about 100 ms, so that RL training and agent evals can fork entire environments instead of resetting them.

Code at github.com/katakate/k7d · docs at docs.katakate.org

Star k7d on GitHub

  1. I built a Rust VMM that forks a live Kubernetes cluster in ~100 ms Why RL needs byte-identical environments, and the three mechanisms that make a 100 ms cluster fork possible.
  2. Why not Firecracker, Kata, QEMU, or an E2B-style sandbox? The design space of forkable environments: what RL demands, a fair take on each existing tool, and the one-address-space trade-off k7d accepted.
  3. The 45-second fork: qemu, Longhorn, and a bind-mount keystone Skippable prequel: forking disk-only Docker-in-VM sandboxes with PVC snapshots in ~45 s, and why that ceiling was architectural.
  4. Anatomy of a 100 ms cluster fork Copy-on-write memory, device writes the dirty log never sees, network identity across forks, and restoring timer state.
  5. A snapshot tree for agents: fork, protect, prune, rollback How an agent's search over environments becomes a snapshot tree the daemon keeps under RAM and disk budgets — and how to wire it to a GRPO trainer.
  6. Proving the fork: Kani, Aeneas, and budgets as CI Kani on the unsafe memory math, Aeneas→Lean on the eviction model, an axiom allowlist, and latency budgets enforced as CI assertions.