By NetBSD 11.0 shipped August 1 with something genuinely worth benchmarking: a kernel variant that boots a full virtual machine in roughly 10 milliseconds. That is faster than most CI/CD containers take to initialize their runtimes, and it is not a stripped unikernel. You get a complete NetBSD userland, a shell, pkgin, and the crash debugger — just booted in 10ms. The release also delivers the first stable 64-bit RISC-V BSD port and closes long-standing Linux binary compatibility gaps that kept epoll-dependent software off BSD systems.
The MICROVM Kernel
The headline feature is a new kernel configuration called MICROVM. It boots under QEMU or Firecracker using PVH (Para-Virtual Hardware) boot — a protocol that hands control directly to the OS, bypassing BIOS and ACPI entirely. Device discovery happens via VirtIO MMIO rather than PCI bus enumeration, shaving out a whole category of probe-and-wait overhead. The result is ~10ms on modern x86 hardware.
For comparison: AWS Firecracker, the purpose-built microVM engine behind Lambda, achieves around 125ms. A standard QEMU Linux VM takes several hundred milliseconds. NetBSD 11’s MICROVM undercuts both by a factor of 10 or more.
The practical layer on top is smolBSD — a tool that builds 10MB bootable images from the MICROVM kernel. One command, one 10MB image, ready to boot under QEMU or Firecracker. On Proxmox VE, where the hypervisor path differs slightly from raw QEMU PVH, smolBSD users are reporting 31ms boots. Either way, you are looking at VM startup times that make per-request VM isolation viable for CI/CD pipelines that previously had to settle for containers.
The case for this over containers is real: you get full kernel isolation, not shared-kernel risk, at image sizes and startup times that make the tradeoff reasonable. smolBSD images run around 10MB — comparable to Alpine Linux. Infrastructure teams evaluating security posture for ephemeral build environments should take a serious look.
RISC-V: The First Stable BSD Port
NetBSD 11.0 is the first BSD operating system to ship a stable, officially supported 64-bit RISC-V port. That distinction matters. Linux has had RISC-V support since 2017. BSD has been either experimental or absent. Now it is not.
Supported hardware at launch: the StarFive VisionFive 2, PINE64 STAR64, and any device based on the StarFive JH7110 SoC. Basic support also covers the Allwinner D1, used in the MangoPi MQ Pro. QEMU is fully supported for RISC-V development without dedicated hardware, including Goldfish RTC, VirtIO networking, disk, and audio.
The port includes PCI and PCIe device support, VirtIO networking and storage, hardware random-number generation, temperature sensors, and ddb — NetBSD’s crash kernel debugger. This is not a bare-bones bring-up. It is a functional development environment on open silicon, backed by the full pkgsrc package collection of over 29,000 packages.
RISC-V hardware is moving fast. StarFive and Milk-V are shipping production-grade silicon, and developer boards are available for under $80. For developers building embedded systems, edge appliances, or networking tools on open hardware, this is the first stable BSD starting point.
Linux Compat: epoll and 11 Others
NetBSD’s compat_linux(8) subsystem received its largest expansion in years: twelve new Linux-compatible system calls. The most significant is epoll, implemented on top of NetBSD’s native kqueue mechanism. That one addition means Node.js, nginx, Redis, and every libuv-based application can now run pre-built Linux ELF binaries on NetBSD without recompilation.
The other eleven: inotify (also via kqueue), clone3, statx, readahead, close_range, waitid, renameat2, sync_file_range, syncfs, the POSIX message queue family (mq_*), and memfd_create. These close the gaps that caused pre-built Linux binaries to crash or refuse to start on NetBSD systems.
NetBSD’s approach — mapping epoll onto kqueue rather than implementing epoll natively — is architecturally sound. kqueue is the more general of the two APIs. The semantics translate cleanly. Developers running BSD-based infrastructure, network appliances, or edge systems can now pull in a wider range of pre-built Linux tooling without maintaining a separate build pipeline.
The Release Itself
NetBSD 11.0 took 18 months and seven release candidates. Beyond the headline features: POSIX.1-2024 and C23 compliance improvements ship (lint gains C23 support, a new c17 compiler wrapper is included), the TCP initial retransmission timeout drops from 3 seconds to 1 second per RFC 6298, and npf(7) gains layer 2 and user/group filtering.
NetBSD gets labeled as the niche BSD — the one for obscure hardware. The 11.0 release earns that label on the RISC-V side, and then immediately challenges it with the MICROVM kernel. A 10ms boot time and the smolBSD toolchain make this relevant for infrastructure engineers who have never thought seriously about BSD. If you are spinning ephemeral VMs in CI or evaluating isolation primitives for build environments, the entry point is lower than it looks. Full announcement and release notes are at blog.netbsd.org.
