Comment by dekhn

6 hours ago

It still amazes me just how nonstandard the sandbox in browsers is.

The browser should be a VM host.

VMs are pretty heavy-weight to run all the JavaScript on a modern page. A proper VM requires a dedicated kernel. Firecracker boots the whole 40MB Linux kernel just to run a "function". A container doesn't have this baggage, but would never be considered secure enough for the web environment.