Tangled CI Runs on MicroVMs
Tangled, a Git-based issue tracker, now runs its CI pipeline on Fly.io using MicroVMs with Spindle, replacing GitHub Actions. This setup uses Firecracker micro-VMs and a custom HTTP API, named Hoo, for running CI jobs. The architecture provides isolated, fast, and cost-effective execution environments, processing hundreds of CI jobs daily with minimal overhead and enabling rapid iteration.
Background
Tangled is a CI/CD platform for developers. This blog post describes its technical decision to run build pipelines inside lightweight MicroVMs (virtual machines based on Firecracker, an open-source VM monitor from AWS) instead of using traditional containers (like Docker). MicroVMs offer stronger security isolation than containers while booting much faster than full VMs. The piece explains how Tangled builds custom Linux kernel images and uses a tool called `userboot` to boot them in under a second. For readers familiar with Docker’s convenience but concerned about its shared-kernel security model, this is a real-world case of trading some convenience for a harder security boundary in CI.