Copy-on-write

Copy-on-write gives each sandbox a view over a shared base image and stores only what that sandbox changes.

A sandbox is created fast mostly because the sandbox runtime avoids work. The runtime does not copy the root filesystem for a new sandbox. The root filesystem is a copy-on-write view over a base image that is already on the host. Creation therefore costs almost nothing, and each sandbox stores only what it changes. Copy-on-write filesystems are one of the techniques behind cold starts measured in milliseconds, next to a warm pool and snapshot restore.