Hacker News Reader

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

> Do you do this at the chromium/V8 level or CDP?

Deepest level possible, harder but required for some workflows

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

I get why it can look like we're “lying” to website operators, that’s a fair concern.

But stealth, as we see it, isn’t about deception for abuse. It’s about making automated access behave closer to how real users interact with the web, in an ecosystem where most anti-bot systems default to blocking everything that isn’t explicitly whitelisted.

Right now, the model is broken. Unless you have a direct partnership, you're often locked out, even for legitimate use cases like research, monitoring, or building user-facing tools on top of public data.

We’re not supporting harmful behavior (credential stuffing, DDoS, piracy, etc.). The goal is to enable responsible access to publicly available information without forcing every use case into closed-door agreements.

There’s also a real tradeoff happening. Increasingly aggressive anti-bot measures (like harder CAPTCHAs) degrade the experience for actual users, while not necessarily stopping sophisticated automation, robots solve CAPTCHAs better than humans.

So the question isn’t “bots vs no bots” — it’s what kinds of automated access should exist, and under what norms. Right now, that line is blurry, and we think there’s room for better balance.

Happy to engage on where that line should be drawn.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Im super interested on that, please let me know if you manage to detect their browsers!

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

The state does not contain the browser config, since it's configured just before it starts running (and we currently snapshot before Chromium starts).

In our case, we prepare the environment, load files that we need later and then we create the state. Once we start, we instantly start Chromium with the config requested by the customer.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Oh my bad. You mean warm pools then. That works, yes, but you need to maintain that warm pool, which might not be ready if we receive a big burst of demand

Keeping the browser open and warm is also a problem, not all customers require the same features. The same engineering required to fix that (modifying values with Chromium open), also fixes the post-chromium snapshot

VM takes 20ms to start, browser around 300ms. Post-Chromium snapshot is at 50ms end-to-end, defeating the benefits of the warm pool you suggest, that will be our next step.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Fair. We bill by minute cause our main use case is web automation. If you compare per minute, Lambdas are 4-6x more expensive than our solution

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Really depends on the server specs. Tab amount relies entirely in memory & CPU availability, not in the infra that runs behind the scenes

But yeah, in one server we can fit hundreds of browsers, or even thousands if we use bigger servers. And each one of them with dozens of tabs, no issue

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Starting the VM itself takes 20ms with Firecracker, the slowest part is starting the browser.

So there's no benefit on reusing the VM but not the browser. VM isolation is also important, customers can leave downloads and other files that should not be accessible for freshly created browsers on that same VM.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

I've experimented with Android Browsers. The problem is that android VMs are super heavy compared to the resources needed to run just Chromium

Startups are absurdly slow, isolation is harder, etc...

Android bloat is insane, you need to run the entire Java VM to start the browser... It's also harder to fingerprint, and at scale that's something that we need for Browser Use

Cool experiment but not yet production ready, at least for us

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Yes, warm pool work, but our goal is to replace them at all.

Warm pools are nice but at the end they also consume resources, And you need to always keep the pool warm, starting browsers to balance, etc...

With the upcoming changes we will keep Chromium startup and the VM will be ready in 50ms, defeating warm pools at all

Also some customers need special parameters and features, increasing warm pools complexity. The happy path will be fast but the edge case will be extremely slow , and we want to guarantee fast speeds to matter which features you need on the requested browser.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Not all use cases require all the features that we built

Few issues we had with lambas: - Limited running time (15 min), we support up to 4 hours (we can run longer if needed) - Price - Lack of snapshotting mechanisms - Lack of low-level control over the running host

But yeah, lambda is way more than enough for most common use cases automating the web

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Checkpoint with Chromium running is possible and will be our next step.

Main blockers right now is fingerprint injection and profile injection, solved already.

It's always a balance of engineering effort & gains. Post-Chromium snapshot let's us save 200ms, which is not that important for 99% of use-cases, but that will come soon since it brings some other benefits (like CPU footprint)

Profiling and tools used are already included with Chromium, they provide nice debugging tools

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

We decided to maintain Chromium as engine for stealth purposes.

Browsers like LightPanda lack stealth at all, they are trivial to detect. There are ways to make Chromium more performant, by removing everything that you don't need.

We believe that Chromium can reach that performance without starting an entire engine from scratch, and without losing stealth, a top priority for us.

The language is not the problem, C++ is as performant as Zig, but Chromium bloat is huge, agree on that.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

It's not cheaper, slower startup, we lose full control and the environment is not optimized to run Chromium, so we also lose performance

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Browsers can't be reused between customers. They contain sensitive and private data. Everything needs to be isolated and ephemeral.

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Our previous solution (Unikraft) did not supported auto-scaling

That's why we moved to a fully in-house solution with Firecracker and auto-scaling on EC2

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

> Browser stealth has been a solved problem for some time now

That's not true. Bots can still automate the web and there's demand for products that allow it. It's harder than years ago, but not impossible.

Defenders are always in favor, but the demand for automating the web exists, so research keeps going. There are ways to hide everything, including residential proxies.

For reference, I'm the blog author, and I have another one talking about this topic: https://browser-use.com/posts/bot-detection

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Our browsers beat competitors in performance too. Chrome uses mainly CPU, not GPU

We support GPU via software tho

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

We persist profiles to maintain sessions if needed, this includes cookies, session storage and everything needed to keep your account logged in

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Yes, it is. It was a challenge to make it work smooth without metal. The scaling out speed was one of the main reasons

Reformedoton How we run Firecracker VMs inside EC2 and start browsers in less than 1s

Docker does not isolate, consumes more resources and is slower

Reformedoton Browser agent bot detection is about to change

Protection approaches vary wildly across industries and sites, and what counts as "suspicious" looks completely different depending on the context and websites.

Our focus is on staying ahead by eliminating signals that antibots aren't even checking yet, that's where the real research challenge is.

Benchmarks comparing competitors across high-security sites are coming soon, thanks for reading!