a microVM
/ MY-kroh-VEE-EM /
Containers are fast but share the host kernel; virtual machines isolate hard but are heavy. A microVM is the engineering answer to 'can we have both?' - a deliberately stripped-down virtual machine designed to boot in milliseconds and use only a few megabytes of overhead, so it feels as light as a container while keeping a virtual machine's separate kernel and hypervisor boundary. The flagship example is Amazon's Firecracker, built to back serverless platforms where thousands of tiny, untrusted workloads must each get strong isolation without the cost of a full traditional VM.
How it stays small: a microVM monitor like Firecracker throws away almost everything a normal VM emulates. There is no BIOS, no legacy device emulation, no slow boot path - just a minimal device model, typically only paravirtualized virtio devices for disk and network, a serial console, and a timer. It loads the guest kernel directly and jumps in. Because there is so little to set up and so few devices to emulate, a microVM can boot a Linux kernel in well under a second and the monitor itself is a small, memory-safe program (Firecracker is written in Rust) with a tiny attack surface. You still get a real guest kernel running under hardware-assisted virtualization, so the isolation is VM-grade, not namespace-grade.
The converging middle ground has two flavours worth distinguishing honestly. One is the microVM (Firecracker): a tiny real VM with its own guest kernel, isolated by the hypervisor. The other is the user-space-kernel sandbox, exemplified by gVisor, which takes a different route: it does not run a separate guest kernel at all, but intercepts the container's system calls and re-implements much of the kernel's behaviour in a user-space process, so the application's calls hit gVisor's reimplementation rather than the host kernel directly - shrinking how much of the real kernel an attacker can reach. Both aim at the same target, container-like speed with much-better-than-container isolation, and both now plug in as OCI-compatible runtimes. The honest caveat: neither is free - microVMs still pay some virtualization overhead, and gVisor's system-call interception adds latency and does not implement every kernel feature perfectly.
Firecracker boots a Linux microVM with just virtio-net and virtio-blk, a serial console, and a timer - no BIOS, no PCI bus to probe - so it starts in around 125 milliseconds and adds only a few MiB of overhead, yet the guest has its own kernel behind KVM.
A microVM strips a VM down to virtio devices and a timer - container speed, VM-grade isolation.
MicroVMs (separate guest kernel, e.g. Firecracker) and user-space-kernel sandboxes (no guest kernel, e.g. gVisor) are different approaches to the same goal and are NOT the same thing. Neither is free: virtualization or syscall-interception overhead remains, and gVisor does not perfectly cover every kernel feature.