Firecracker is an open source virtualization technology that is purpose-built
for creating and managing secure, multi-tenant container and function-based
services that provide serverless operational models. Firecracker runs workloads
in lightweight virtual machines, called microVMs, which combine the security and
isolation properties provided by hardware virtualization technology with the
speed and flexibility of containers.
Overview
The main component of Firecracker is a virtual machine monitor (VMM) that uses
the Linux Kernel Virtual Machine (KVM) to create and run microVMs. Firecracker
has a minimalist design. It excludes unnecessary devices and guest-facing
functionality to reduce the memory footprint and attack surface area of each
microVM. This improves security, decreases the startup time, and increases
hardware utilization. Firecracker has also been integrated in container
runtimes, for example
Kata Containers and
Flintlock.
Firecracker was developed at Amazon Web Services to accelerate the speed and
efficiency of services like AWS Lambda and
AWS Fargate. Firecracker is open sourced
under Apache version 2.0.
To get started with Firecracker, download the latest
release binaries
or build it from source.
You can build Firecracker on any Unix/Linux system that has Docker running (we
use a development container) and bash installed, as follows:
git clone https://github.com/firecracker-microvm/firecracker
cd firecracker
tools/devtool build
toolchain="$(uname -m)-unknown-linux-musl"
The Firecracker binary will be placed at
build/cargo_target/${toolchain}/debug/firecracker. For more information on
building, testing, and running Firecracker, go to the
quickstart guide.
The overall security of Firecracker microVMs, including the ability to meet the
criteria for safe multi-tenant computing, depends on a well configured Linux
host operating system. A configuration that we believe meets this bar is
included in the production host setup document.
Contributing
Firecracker is already running production workloads within AWS, but it's still
Day 1 on the journey guided by our mission. There's a lot more to
build and we welcome all contributions.
New Firecracker versions are released via the GitHub repository
releases page,
typically every two or three months. A history of changes is recorded in our
changelog.
Firecracker consists of a single micro Virtual Machine Manager process that
exposes an API endpoint to the host once started. The API is
specified in OpenAPI format. Read
more about it in the API docs.
Start the microVM using a given kernel image, root file system, and boot
arguments.
[x86_64 only] Stop the microVM.
Built-in Capabilities:
Demand fault paging and CPU oversubscription enabled by default.
Advanced, thread-specific seccomp filters for enhanced security.
Jailer process for starting Firecracker in production
scenarios; applies a cgroup/namespace isolation barrier and then drops
privileges.
Tested platforms
We test all combinations of:
Instance
Host OS & Kernel
Guest Rootfs
Guest Kernel
m5n.metal (Intel Cascade Lake)
al2 linux_5.10
ubuntu 24.04
linux_5.10
m6i.metal (Intel Ice Lake)
al2023 linux_6.1
linux_6.1
al2023 linux_6.18
m7i.metal-24xl (Intel Sapphire Rapids)
m7i.metal-48xl (Intel Sapphire Rapids)
m8i.metal-48xl (Intel Granite Rapids)*
m8i.metal-96xl (Intel Granite Rapids)*
m6a.metal (AMD Milan)
m7a.metal-48xl (AMD Genoa)
m6g.metal (Graviton 2)
m7g.metal (Graviton 3)
m8g.metal-24xl (Graviton 4)
m8g.metal-48xl (Graviton 4)
m9g.metal-48xl (Graviton 5)
*: We only support AWS EC2 8th Gen Intel (*8i) instances using a 6.1
or 6.18 host kernel. This is due to poor kernel support for Granite Rapids CPUs
on 5.10.
Known issues and Limitations
The pl031 RTC device on aarch64 does not support interrupts, so guest
programs which use an RTC alarm (e.g. hwclock) will not work.
Performance
Firecracker's performance characteristics are listed as part of the
specification documentation. All specifications are a part
of our commitment to supporting container and function workloads in serverless
operational models, and are therefore enforced via continuous integration
testing.
Policy for Security Disclosures
The security of Firecracker is our top priority. If you suspect you have
uncovered a vulnerability, contact us privately, as outlined in our
security policy document; we will immediately prioritize your
disclosure.
FAQ & Contact
Frequently asked questions are collected in our FAQ doc.
You can get in touch with the Firecracker community in the following ways:
Firecracker 是一项开源虚拟化技术，用于创建和管理安全的多租户 microVM，服务于基于容器和函数的无服务器工作负载。