I built a self-hosted Fly.io engine using Go and Firecracker
Firecracker microVMs from Docker images with built-in L7 proxy and wake-on-request.

Idle VMs snapshot to disk and wake in 3.7ms, making serverless VMs actually viable.
Developers needing isolated sandboxes without paying for idle compute
Fly.io · Railway · Render
- Each VM has its own kernel, filesystem, and IP
- Idle VMs pause their CPUs and snapshot themselves to disk; the next request wakes them in 3.7ms warm or 360ms cold (p50, Hetzner AX102)
- Publish any port → public URL with auto-wake on first hit
- Pull any OCI/Docker image as a rootfs, or save a running sandbox as one
- Multi-tenant from day one — per-user bridges, encrypted secrets, rate limits
- Single Go binary, Apache 2.0
The decisions page is the most fun read on the site: vsock state after restore, why all snapshots are Full, the systemctl shim, the ARP retransmit trick.
curl -fsSL bhatti.sh/install | sudo bash
(sudo because the daemon needs /dev/kvm and sets up the Firecracker jailer + a bridge; the CLI-only install — pipe to plain `bash` — needs no root)
Site: https://bhatti.sh
Repo: https://github.com/sahil-shubham/bhatti
Decisions & learnings: https://bhatti.sh/docs/under-the-hood/decisions/
Firecracker microVMs from Docker images with built-in L7 proxy and wake-on-request.
Snapshotting running TCP connections to disk in milliseconds is genuine wizardry.
Self-hostable jam.dev alternative with auto-context capture; AGPL limits commercial adoption.
Gluetun namespace isolation beats firewall rules for leak-proof torrenting.
Drop-in Slack alternative with verifiable crypto, but one-time secret sharing exists.
Headless testimonial API that lets agencies build custom widgets without SaaS fees.