I’m somebody who’s always online, always trying to catch the “next big thing” in tech—and somehow this one slipped past my radar. AWS quietly shipped what I genuinely think is the biggest EC2 update in a long time: nested virtualization on virtual (non–bare metal) EC2 instances. In plain terms, EC2 VMs can now expose KVM (/dev/kvm) so you can run another layer of virtualization inside them—meaning things like Firecracker can finally run on smaller EC2 instances, not just massive bare metal boxes. In the video, I break down why this matters by contrasting container isolation (Docker sharing the host kernel) with VM-style isolation (Firecracker using KVM). If you’re running untrusted workloads, kernel-sharing is always a risk model you have to think about, and Firecracker’s approach gives you stronger isolation boundaries. Historically, AWS didn’t allow this on regular EC2 VMs, which was ironic because AWS built Firecracker. Now with C8 (and related) instance families supporting nested virtualization, you can get the security + fast-boot benefits of Firecracker without paying for oversized bare metal. I also share a real migration story from my own workload: I tried the “no-KVM” Page-Based Virtual Machine approach and hit instability (segfaults). This new AWS support changes the cost/performance equation dramatically—and brings AWS closer to what Azure, GCP, and even DigitalOcean have supported for a while.