firecracker

Firecracker is an open-source virtualization technology purpose-built for creating and managing secure, multi-tenant container and function-based services with serverless operational models. It runs workloads in lightweight virtual machines called microVMs, which aim to combine the security and isolation of hardware virtualization with the speed and flexibility of containers. The core component is a virtual machine monitor (VMM) built on the Linux Kernel Virtual Machine (KVM). Its design is deliberately minimalist: it excludes unnecessary devices and guest-facing functionality to reduce memory footprint and attack surface, which the project states improves security, shortens startup time, and increases hardware utilization. Firecracker was developed at Amazon Web Services to support services such as AWS Lambda and AWS Fargate, and is released under Apache 2.0. It has also been integrated into container runtimes including Kata Containers and Flintlock. Once started, Firecracker exposes an API endpoint to the host, specified in OpenAPI format. Through this API users can configure a microVM's vCPU count (default 1) and memory size (default 128 MiB), apply CPU templates, attach network interfaces, add read-write or read-only file-backed block devices, trigger block device re-scans while the guest runs, swap a block device's backing file before or after boot, configure rate limiters for virtio devices, set up logging and metrics, add vsock, entropy, and pmem devices, manage memory hotplugging, and (in developer preview) hot-plug or hot-unplug virtio PCI devices. A microVM is started with a kernel image, root file system, and boot arguments; stopping is supported on x86_64 only. Built-in capabilities include demand fault paging, CPU oversubscription by default, thread-specific seccomp filters, and a Jailer process that applies cgroup/namespace isolation and drops privileges for production deployments. Getting started is possible by downloading release binaries or building from source. Building requires a Unix/Linux system with Docker and bash; the project provides a development container and a devtool build command, with the binary placed under build/cargo_target. Documentation covers a quickstart guide, production host setup, design, API requests, CPU templates, vsock, entropy, pmem, memory hotplug, device hotplug, and jailer usage. Releases are published on GitHub roughly every two to three months with a changelog and a documented release policy. The project publishes a tested-platform matrix covering AWS EC2 metal instances across Intel, AMD, and Graviton families with various host kernels, guest rootfs, and guest kernels. A known limitation is that the pl031 RTC device on aarch64 does not support interrupts, so guest programs relying on RTC alarms (such as hwclock) will not work. Performance characteristics are documented in a specification file and enforced through continuous integration testing. Security disclosures are handled privately per the project's security policy, and community contact is available via Slack, GitHub issues, and email.