Vercel's Hive: A New Compute Layer for Builds

Running untrusted code on shared hardware requires an infrastructure designed from the ground up for secure isolation. Vercel's answer is Hive, a low-level compute platform that has powered all Vercel builds since November 2023. The platform was built to give the team finer-grained control over build execution, resulting in a 30% improvement in build performance and a dramatic reduction in provisioning times for Secure Compute customers—from 90 seconds down to 5 seconds.

Architecture Components

Hive is organized into regional clusters, with a single "Hive" referring to a top-level cluster that operates as an independent failure domain. Multiple hives can run in the same region. Each cluster is composed of four main pieces:

  • Box: The bare metal host machines running the virtualization layer. Optimizations at this level include Docker image caching, cutting VM startup times from almost 2 minutes to around 45 seconds less, plus block device snapshotting to avoid repetitive boot work.
  • Cell: A virtual machine instance. Each cell runs at least one container and is assigned dedicated CPUs and memory. Disk and network throughput are rate-limited based on how the box is partitioned.
  • Control plane: Handles orchestration duties—job placement, autoscaling, instance lifecycles, monitoring, and cluster health.
  • API: A minimal per-hive interface primarily responsible for requests to run cells.

Each Hive instance has a dedicated API, control plane, and boxes that spawn cells for running your builds.

This separation of concerns lets Hive handle multiple use cases and scale horizontally. Since each hive is its own failure boundary, a problem in one cluster doesn't affect builds running elsewhere.

How Cells Execute

The virtualization stack sits on Kernel-based Virtual Machine (KVM), providing full hardware virtualization on x86 Linux hosts. Each box runs multiple Firecracker processes—an open-source microVM technology—with a 1:1 mapping between a Firecracker process and a cell. This gives every tenant private virtualized hardware with strong isolation between workloads.

A box daemon runs on each physical machine, coordinating the lifecycle of cells. It provisions block devices, spawns Firecracker processes, and manages communication with cells via a dedicated socket connection. Inside each cell, a cell daemon maintains that communication and controls the build containers themselves: when a build request arrives, the cell daemon starts, stops, or runs the necessary containers through the container runtime.

A box daemon handles provisioning, spawning Firecracker processes, and managing cell lifecycles via a socket connection with a cell daemon.

This two-daemon architecture keeps the heavy lifting outside the VM while maintaining tight control over container execution, balancing isolation against startup speed.

Anatomy of a Build Run

When a build is triggered, the build pipeline selects an appropriate hive cluster based on customer and build configuration, then uses the Hive API to run the build inside a container within a cell. Hive itself doesn't manage container internals—the build pipeline supplies the container image, with Hive responsible only for running and scaling the execution environment.

Because the build container image is large, it's typically pre-cached and pre-loaded in a cell. VMs boot in just a few seconds, so Hive maintains a pool of pre-warmed cells ready to accept work. If one is available, the build begins immediately. For traffic spikes or specialized workloads like Secure Compute, a fresh cell must be provisioned—a process that takes about 5 seconds. When the build finishes, the cell is destroyed.

The Vercel Build Pipeline interfaces with multiple Hive instances globally, each scaling to meet build demands.

Measured Impact

The shift to Hive has produced measurable gains across several dimensions. Overall build times are down 20% compared to the previous system. For builds requiring new cell creation, the improvement is more pronounced: provisioning dropped from nearly 90 seconds to 5 seconds, with corresponding build times falling 40%.

Beyond raw speed, Hive has delivered steadier performance and opened up new product capabilities. The platform's finer-grained resource control made it possible to offer enhanced machines with additional memory or disk for customers with heavier workloads.

The team is continuing to push performance further, focusing on caching strategies, optimized cloning processes, and overall execution efficiency. As a general-purpose compute system, Hive was designed for more than builds—Vercel is exploring additional use cases beyond web build execution.