Repository navigation
feat(serverless): add AWS MicroVM support - #9709
Conversation
BenchmarksBenchmark execution time: 2026-08-31 14:17:11 Comparing candidate commit 1d62f2a in PR branch Found 1 performance improvements and 0 performance regressions! Performance is the same for 2301 metrics, 8 unstable metrics.
|
|
✅ All CI checks and tests passed. Datadog automation helped this PR pass. 🎉 All green!🧪 All tests passed 🔄 Datadog retried 1 test - 1 passed on retry 🎯 Code Coverage (details) 🔗 Commit SHA: 1d62f2a | Docs | View more details | Give us feedback! |
a51cd9a to
197ad3b
Compare
Overall package sizeSelf size: 8.58 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.4.0 | 127.33 kB | 447.04 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
![datadog-prod-us1-6[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
The normal clone-resume path refreshes all tested identities, but an entropy-source exception escapes the first /run callback and can terminate the MicroVM instead of being contained by the tracer.
📊 Validated against 9 scenarios · Open Bits AI session
🤖 Datadog Autotest · Commit 197ad3b · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #9709 +/- ##
========================================
Coverage 98.60% 98.61%
========================================
Files 992 993 +1
Lines 149800 150186 +386
Branches 12758 12688 -70
========================================
+ Hits 147704 148099 +395
+ Misses 2096 2087 -9
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 197ad3b6fc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
197ad3b to
6cac3ff
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6cac3ff8f8
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1eff80fb46
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
1eff80f to
9fd2537
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 50a2c1f3e2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
BridgeAR
changed the title
50a2c1f to
918bffb
Compare
918bffb to
4608d46
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4608d46ccb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Lambda MicroVM snapshots preserve buffered random data and cached process identity. Resumed clones can therefore reuse trace IDs or report the source VM's runtime and remote-configuration IDs. The /run lifecycle hook discards Node's UUID pool before regenerating core identity. It then stores updated service-discovery metadata and refreshes consumers after the new IDs exist. DogStatsD, runtime metrics, crash tracking, profiling, OpenTelemetry, span statistics, Test Optimization, agentless exporters, and telemetry now use the current identity. Subscriptions follow each owner's lifetime, and unchanged DogStatsD tags preserve buffered metrics. Bundled OpenSSL remains unsupported because it retains snapshot DRBG state, so the tracer reports that configuration.
4608d46 to
1d62f2a
Compare
Firecracker snapshots preserve OpenSSL's DRBG state and userspace entropy buffers. Clones can therefore emit duplicate trace IDs, span IDs, runtime IDs, and Remote Configuration client IDs. Images identified by AWS_LAMBDA_MICROVM_IMAGE_ARN register a single-use hook for the Lambda MicroVM run endpoint. The hook remains active when normal tracer initialization fails. On resume, it discards buffered UUID entropy, reseeds trace and span ID generation, and regenerates process identifiers. Metadata updates before long-lived consumers refresh, so exports, metrics, profiles, crash reports, OpenTelemetry resources, and child processes use one consistent identity. Node builds with bundled OpenSSL cannot obtain SnapSafe reseeding after resume. The tracer reports an actionable image-build error because identity refresh cannot guarantee unique IDs in that configuration.
Firecracker snapshots preserve OpenSSL's DRBG state and userspace entropy buffers. Clones can therefore emit duplicate trace IDs, span IDs, runtime IDs, and Remote Configuration client IDs. Images identified by AWS_LAMBDA_MICROVM_IMAGE_ARN register a single-use hook for the Lambda MicroVM run endpoint. The hook remains active when normal tracer initialization fails. On resume, it discards buffered UUID entropy, reseeds trace and span ID generation, and regenerates process identifiers. Metadata updates before long-lived consumers refresh, so exports, metrics, profiles, crash reports, OpenTelemetry resources, and child processes use one consistent identity. Node builds with bundled OpenSSL cannot obtain SnapSafe reseeding after resume. The tracer reports an actionable image-build error because identity refresh cannot guarantee unique IDs in that configuration.
Firecracker snapshots preserve OpenSSL's DRBG state and userspace entropy buffers. Clones can therefore emit duplicate trace IDs, span IDs, runtime IDs, and Remote Configuration client IDs. Images identified by AWS_LAMBDA_MICROVM_IMAGE_ARN register a single-use hook for the Lambda MicroVM run endpoint. The hook remains active when normal tracer initialization fails. On resume, it discards buffered UUID entropy, reseeds trace and span ID generation, and regenerates process identifiers. Metadata updates before long-lived consumers refresh, so exports, metrics, profiles, crash reports, OpenTelemetry resources, and child processes use one consistent identity. Node builds with bundled OpenSSL cannot obtain SnapSafe reseeding after resume. The tracer reports an actionable image-build error because identity refresh cannot guarantee unique IDs in that configuration.
Firecracker snapshots preserve OpenSSL's DRBG state and userspace entropy buffers. Clones can therefore emit duplicate trace IDs, span IDs, runtime IDs, and Remote Configuration client IDs. Images identified by AWS_LAMBDA_MICROVM_IMAGE_ARN register a single-use hook for the Lambda MicroVM run endpoint. The hook remains active when normal tracer initialization fails. On resume, it discards buffered UUID entropy, reseeds trace and span ID generation, and regenerates process identifiers. Metadata updates before long-lived consumers refresh, so exports, metrics, profiles, crash reports, OpenTelemetry resources, and child processes use one consistent identity. Node builds with bundled OpenSSL cannot obtain SnapSafe reseeding after resume. The tracer reports an actionable image-build error because identity refresh cannot guarantee unique IDs in that configuration.
5 participants
…VM clone resume
Firecracker snapshots a process's full memory — including OpenSSL's DRBG
state, the id.js batch buffer and its cursor, and the uuid() call's
internal buffer. Every clone that resumes from the same snapshot starts
from the identical PRNG state, so all clones produce the same trace/span
IDs, runtime-id, and RC client ID until those states happen to diverge.
Root cause: three independent entropy consumers are all frozen in the snapshot: