Docs
PricingConsole

The microVM

Last updated 2 November 2026

View .md

Machines are not open yet. These pages describe Machines as they will open; until then, a create answers region_not_offered (422), “Machines are not offered in any region yet.”

Read this when you want to know what runs your image: the virtual machine, the agent inside it, and how a wake boots it and a sleep stops it.

The hosts

Machines run on arm64 metal hosts of their own, apart from the hosts that run Tonbo’s services, with one host always on in each region and more added as Machines wake. A host runs tonbo-node, Tonbo’s host agent, which starts and stops the virtual machines and pulls their images (see Image pulls).

The virtual machine

Each wake is one Firecracker microVM on KVM, started under Firecracker’s jailer (see Isolation claims); Firecracker’s documents live in its repository. Its vCPUs share the host’s cores, and a host admits no more memory than it has, so no Machine’s memory is overcommitted; each is bounded by its cgroup.

Its drives

  • The tools drive, which holds tonbo-guest, the agent inside the virtual machine, at /tonbo.
  • The image root: the image’s layers flattened into one ext4 filesystem with 1 GiB free, a fresh copy at every boot.
  • The scratch drive at /scratch, as large as the shape allows, allocated as it is written, and empty at every boot (see Release, not suspend).
  • The Volume drive, when the Machine has a Volume: one more virtio-blk drive with ext4, mounted at the Volume’s path and served on the host by a per-Volume daemon in its own jail, which keeps the Volume’s blocks in the region’s chunk store.

Boot

The guest kernel boots the tools drive. tonbo-guest switches into the image root, mounts /run, /dev and /tmp, writes the database token to /run/tonbo in memory, takes the Machine’s configuration from the host, and runs the image’s Entrypoint and Cmd as its User, as the image configuration names them.

Stop

A planned stop that releases the Machine sends the program SIGTERM, waits the stop grace, then kills it, and the host sends what the database still had to send, within 60 seconds (see Database wiring). A program that exits on its own ends the wake as exited, and one that runs out of memory as oom (see Stops and the drain).