Willow Creek had one theatre.

It came down to Old Ke from his grandfather. Four walls, one roof, nanmu floorboards that did not creak. Old Ke did not sing. He rented the stage. Whatever troupe came through town rented it, built its own set, hung its lamps, tuned its strings, and tried its postures — into the yard before dawn, waiting for the first gong.

Building the stage took four double-hours.

The town held a market on every fifth and tenth day. The market was crowded, and people came in a hurry and left in a hurry. By the end of the morning watch, four villages’ worth of people packed the long street; by the beginning of the next watch, only a few pole-carriers were left. Those four double-hours ate the busiest half of the morning exactly.

Old Ke’s rent was not high. But every troupe that came went home saying: Willow Creek’s stage is fine, you just can’t wait for it.

The next year Old Zheng opened a yard east of town. His stage was lower, made of pine, one wall no more than a fence. Building there took two double-hours. Everyone went to him. That winter Old Ke’s stage stood empty, and he sat on the boards listening to the wind cross them.

His daughter Ah Juan said: Father, being quick to build is not how you win. They are competing over who rings the gong first.

Old Ke said: Then I’ll make the stage dead — set left standing, lamps left burning, strings left taut. A troupe walks in and sings.

Ah Juan said: That doesn’t work. Different troupes, different plays.

Old Ke went and tried anyway.

— —

He picked a troupe called Little Full. Four people, one play: The Night Watch Under the Moon. He put them up in the yard for a month and had them rehearse daily. In the end the four of them could take the stage without looking at each other, raise a hand and find the position already there. The lute player’s hand never left the string. Even the lamp wicks had been trimmed to that exact height — a gust came, and the flame did not waver.

One afternoon, with the four of them halfway through the play, Old Ke shut the yard gate.

He took a stack of paper and a brush out of his coat.

Ah Juan asked: What are you doing?

Old Ke said: Copying.

He walked the stage. Third board in the front row, half a grain of rice caught in the seam. The rope knot on the second pillar on the left was a double hitch, because that pillar leaned half an inch. The third lamp had its wick cut at a slant, so the flame leaned southeast. The lute player’s little finger rested on the fourth string, and the string was still vibrating. The watchman had his left foot on the stage lip, his right foot in the air, the drumstick stopped an inch above the drumhead.

He copied from noon until lamps were lit. Then he rolled it up and put it in a bamboo tube.

The next day a troupe from out of town asked: How long to build the stage?

Old Ke handed them the tube.

— —

The first time, it worked.

The outsiders read off the paper and set the stage piece by piece: this board, this knot, this slanted wick. At the end the lute player put his finger on the fourth string, and the watchman lifted the stick.

And the four of them were suddenly there.

Not warming up. In one breath, the thread was joined.

Standing below, Old Ke watched the audience blink — because the half morning they were supposed to wait for was gone. The play began in the middle, and they could not tell where the middle was, because no one had ever sung on that stage that way.

That night the whole town heard that Willow Creek rang its gong fastest. Three troupes came the next day.

The third one could not do it.

It was not The Night Watch they wanted to sing. It was The White Snake. The first line did not start that way. Ah Juan set the stage from the copy, and halfway through, the singer said: No — here I turn.

Ah Juan said: The paper doesn’t say.

And the stage came apart where it stood.

— —

Old Ke sat through another winter.

In the spring he did a second thing. He stopped copying one troupe and copied the whole yard.

Not one play. The boards, the pillars, the ropes, the lamps, the tiles, the paving, the water jar in the back corridor, the tightness of the door hinge — everything. He copied for seven days. Twenty-seven scrolls.

A troupe would arrive, and he would lay all twenty-seven out on the stage for them to follow.

The result: they could build it, but by the time they finished it was dark.

Laying out scroll after scroll cost about what building from scratch cost.

That day Ah Juan said: Father, you didn’t copy too much. You unrolled too early.

Old Ke asked: What does that mean?

Ah Juan said: Who unrolls a whole yard at the door? First he steps on the boards. Then he looks up at the pillars. Then he looks at the lamps. Wait until he asks. He asks for a scroll, you unroll that scroll.

— —

So Old Ke hung all twenty-seven at the doorway, one to a slot, the cord ends dangling. Whichever slot was called for, Little Six at the door pulled that scroll and laid it on the stage.

The change was frighteningly fast. The first troupe walked in, Little Six pulled three scrolls, and the gong rang.

One extra boy pulling scrolls, and four double-hours gone.

Because those first three scrolls were exactly what every troupe looked at first: boards, pillars, lamps. Of the other twenty-four, half went unused in a year. Old Ke moved the frequently used ones to the outer row and put the rest behind.

By autumn, Willow Creek could nearly promise “tea still warm when the guest arrives.” Old Ke thought the matter was finished.

Then came the fifth of the tenth month, and the great market that comes once in a hundred and twenty years.

That day it was not three troupes. It was a hundred and twenty.

— —

Little Six stood at the door. For the first quarter hour he pulled three times faster than usual.

In the second quarter hour, the doorway jammed.

Because a hundred and twenty troupes wanted a hundred and twenty different plays. The first three scrolls were pulled; after that, nothing matched. And each scroll had only one place in the house — whoever pulled it out, the next troupe could not have it. Little Six started running. By the end his arms would not come up.

Half the troupes never rang a gong that afternoon. Old Ke stood under the eaves and saw a line at his door longer than the one he used to have at the stage.

Ah Juan crouched beside him and said: We aren’t faster than before. We only moved the waiting from the stage to the door.

Old Ke said nothing. That night he found two worse things.

The first: the accounts were wrong.

Two troupes came to collect with the same receipt. The seal read “Willow Creek Yard,” and beneath it a number. The two numbers were identical.

Old Ke dug out the copy and understood. He had copied the gatekeeper’s seal and the accountant’s hourglass along with everything else. What he handed each troupe was a yard that had already been sealed, with half the sand already run. Both troupes walked in at the same moment on the paper.

The second: a corner of the stage collapsed.

Sixteen troupes shared the same floorboard scroll. The thirteenth thought the third board sat low and wedged a roof tile under it. The tile stayed. The sixteenth stepped on it, came down half an inch off, and fell from the stage lip.

Ah Juan said: Anything that gets changed can’t be shared.

— —

That winter Old Ke did four things.

First, he cut the yard down. The old yard had a front gate, a side gate, a back gate, a horse run, a water room, an accounts room, a gatehouse, a wood store, an ear room — forty-seven ways in and out. He tore out forty-four. Three holes remained: one for letters, one for food, one for word of mouth. A smaller yard is quicker to enter. More to the point, anyone trying to get in from outside now had only those three holes to try.

Second, three scrolls always lay open at the door. Nobody had to ask. Those three were what every troupe looked at first.

Third, on the first page of every copy he wrote a line, to be read before entering: A copy that comes in takes a new seal first, and turns a new hourglass first.

Fourth, a line beneath it: A scroll that is only read, a hundred troupes share. A scroll that has been written on, one troupe, one copy.

The next year, Willow Creek could open a hundred stages in a quarter hour. One set of copies, one yard, and no one took anyone else’s.

— —

Later someone asked Ah Juan what had actually been in that bamboo tube.

Ah Juan said: Not a play. A yard that had already grown warm.

Building a yard is not hard. Warm is hard. The boards have been walked smooth, the knots have taken their load, the wicks are trimmed to that height, the strings were tuned a moment ago and are still ringing, and four people’s breath has joined into one line. None of that is built. It is raised, and raising takes time.

So what Old Ke copied was not an empty yard. He copied the instant it had finished being raised.

By now you’ve probably recognized it: this is MicroVM Snapshot-Restore.

What it is

It is the core technique serverless platforms use to push cold start from hundreds of milliseconds down to single-digit milliseconds. Three things stacked:

• A microVM. A virtual machine with only the organs it needs. The device model is cut back to virtio-net, virtio-block, vsock, and a serial port; the VMM itself sits in the tens of thousands of lines (Firecracker about fifty thousand; QEMU is over a million). Each tenant gets its own KVM virtual machine, and what is shared is the hardware virtualization layer, not the kernel — that is the essential difference from a container. Around it sits a jailer: chroot, seccomp, cgroup, network namespace, nailing down the three holes.
• A snapshot. The complete state of a microVM that is already running and already warm, written to a file: every memory page, the CPU registers, the device state. The hard part is not whether you can save it. The hard part is which instant you freeze — the moment after the language runtime has initialized, the JIT has compiled, the connection pool has been built, the dependencies are resident in memory. You are not freezing an empty machine. You are freezing a machine that is exactly ready to work.
• A restore. Restore is mmap the memory file, write back the registers and device state, and continue executing. The boot path is not replayed, so the cost of booting is not paid.

What turns this from workable into cheap is the next two moves:

• Demand paging (userfaultfd). A restore does not read the whole memory file. The memory region is registered with userfaultfd; the first time the guest touches a page that has not been filled, it traps to the host, and only then does the host read that page from the snapshot file. So restore latency scales with how much memory the instance touches immediately, not with how large the snapshot is.
• Shared read-only pages (page cache reuse). Restore the same snapshot a thousand times and all thousand microVMs read one host page cache. A page nobody has written exists once in physical memory. That is why a thousand concurrent copies of the same function do not need a thousand copies of its memory. Whoever writes takes a copy-on-write and gets a page of their own.

Two rules come with this, easy to forget and mandatory:

• Entropy and clock. A restored machine has exactly the RNG state of the original. Without reseeding, two clones generate the same random numbers, the same UUIDs, the same keys. The kernel clock has to be realigned too, or the new instance opens its eyes believing it lives at the instant of the snapshot. So a restore reseeds the entropy pool and resynchronizes time.
• State is toxic. The TCP connections, TLS sessions, DNS cache, tokens, and file locks inside a snapshot all point at a peer that existed then and may not exist now. So the thing you can snapshot is not an arbitrary program but a program that can rebuild its external state: reconnect, re-resolve, re-fetch credentials on restore. This constraint is why serverless functions have to be stateless.

The distinctions matter. Cold boot walks the startup path from zero. A warm pool starts instances ahead of time and lets someone claim one — money buying time. Fork copies a process into a child, sharing kernel objects, with a different isolation strength. Live migration pre-copy moves one running machine somewhere else, one for one. Snapshot-restore freezes one machine and copies it into many: one becomes many.

Why it matters

Its importance is an economic inequality.

A general-purpose VM running one function takes hundreds of milliseconds to seconds to start, and while idle still holds memory and CPU shares. A physical host fits tens of general-purpose VMs. The same host fits thousands of microVMs — each VMM is a few megabytes, the device model is nearly nothing, and an idle one can be swapped out. That density gap is the precondition for billing serverless by the millisecond.

It also resolves a harder tension: isolation strength versus density. Containers share a kernel, so one kernel bug is every tenant’s bug; for multi-tenant untrusted code that is not enough. Virtual machines isolate properly but start expensively and occupy memory, so density suffers. The microVM approach admits that the cost of isolation comes mostly from the device model and the boot path, cuts only those two, and keeps the hardware virtualization boundary. Snapshot-restore then erases boot from the bill entirely.

Its failure modes are equally characteristic, and nearly all of them come from the snapshot carrying the past:

• Page fault storms. Restore defers its latency to the first access. A thousand instances restoring at once, each touching different pages, saturates the host’s fault handling, and restore latency ends up worse than cold boot. Hence: warm the working set, cap concurrent restores, make sure the hot set fits in page cache.
• Snapshot bloat. A memory snapshot is the size of memory. More dependencies and a heavier runtime mean a bigger snapshot and more faults on restore. This is what pushes runtimes to get lighter — serverless’s preference for small runtimes is not aesthetics.
• Stale state. Expired DNS, revoked credentials, connections to a dead peer, config changed elsewhere. The restored instance remembers a world that no longer exists.
• Identical clones. Forget to reseed entropy and a hundred instances produce the same random number. In keys, idempotency tokens, and sampling decisions, that is a disaster.
• Version drift. A snapshot is bound to particular kernel, VMM, and host features. After a platform upgrade, old snapshots either will not restore or restore into strange behaviour. The snapshot library has to be managed alongside platform versions.

So the engineering weight is not in “how do we snapshot.” It is in defining what counts as a snapshottable machine: small working set, rebuildable external state, identity regenerated after restore, and read-only things that are genuinely read-only. Settle those and snapshot-restore becomes a mechanism you can run in production for years, not a handsome demo.

Metaphor mapping

• The Willow Creek stage and yard → one microVM; the nanmu boards, pillars, lamps → the full runtime and memory state
• Four double-hours to build → cold boot: kernel, init, runtime initialization
• Market crowds that come and go fast → a serverless request surge; waiting is lost business
• Old Zheng’s low pine stage with a fence wall → a lighter approach: faster to start, weaker guarantees
• Little Full rehearsing a month until their breath joins → the runtime grown warm: JIT compiled, pool connected, dependencies resident
• Shutting the gate mid-play → freezing at a warm, quiescent instant
• Paper and brush, walking the stage → snapshot: memory pages + registers + device state
• The tube holds not a play but a yard already grown warm → the snapshot stores a ready-to-work state, not the program
• Setting the stage from the copy, suddenly there → restore: map memory, write registers, continue
• The missing line “here I turn” → the snapshot only covers paths already walked; new requests need branches that were never frozen
• Unrolling all twenty-seven, finishing after dark → reading the whole snapshot at restore, costing the same as rebuilding
• Scrolls hung at the door, pulled only when called for → userfaultfd demand paging
• Little Six pulling scrolls alone → the host’s fault-handling thread
• Three scrolls always lying open → warming the working set / prefetch
• Frequent scrolls moved to the outer row → hot-page placement and prefetch order
• A hundred troupes reading one scroll, none allowed to write on it → read-only pages shared through page cache
• The thirteenth troupe wedging in a roof tile → a write; poisoning a shared page
• A scroll that has been written on gets one copy per troupe → copy-on-write
• A hundred and twenty troupes jammed at the door, one slot per scroll → a page fault storm; restore latency deferred to first touch
• The door line longer than the old build queue → restore concurrency too high, worse than cold boot
• Two troupes holding receipts with the same number → forgetting to reseed entropy; identical random numbers and keys
• The hourglass on the copy already half run → a stale clock; time must be resynchronized after restore
• Forty-seven doorways cut down to three holes → a minimal device model plus the jailer (chroot, seccomp, cgroup, network namespace)
• A smaller yard is quicker to enter → a shorter attack surface and a shorter boot path at once
• Three scrolls always open at the door → trading a small working set for few faults
• A troupe too heavy to set up → snapshot bloat: the heavier the runtime, the more expensive the restore
• One for one versus one becoming many → live migration pre-copy and snapshot-restore aim at different things