2026-06-30

Tangled’s writeup on its new QEMU microVM engine for Spindle CI runners

strong reference for agent/container sandbox UX, network lockdown, and self-hosted CI isolation tradeoffs.

Original source

Reading Log X Post Historical Backfill Agents AI Infra Systems

Gist: each workflow runs in its own microVM; guest agent talks back over vsock; NixOS-based workflow config can declaratively enable services like Postgres and Docker; cache/proxy design keeps guests isolated from direct network/cache credentials while still reusing built artifacts.

Newsletter angle: “microVMs as the unit of CI isolation, with NixOS as workflow-defined machine config” is a solid hook.

Retrieval note: extracted via FXTwitter API + linked article fetch.