Firecracker

What is Firecracker?

Firecracker is an open-source Virtual Machine Monitor (VMM) developed by Amazon Web Services. It's designed specifically for creating and managing lightweight virtual machines called microVMs.

Firecracker vs Containers

Feature	Firecracker	Containers (Docker)
Isolation	Hardware virtualization (KVM)	Namespace/cgroup
Security	Stronger (separate kernel)	Shared kernel
Boot time	~125ms	~100ms
Memory overhead	~5MB	~1MB
Attack surface	Very small	Larger
Device model	Minimal	Full host access

note

Firecracker provides stronger isolation than containers because each microVM runs its own kernel instance, completely separated from the host.

Architecture

Key Components

API Server

Firecracker exposes a REST API over a Unix socket for VM management:

Configure machine

curl --unix-socket /tmp/fc.sock -X PUT \
  "http://localhost/machine-config" \
  -d '{"vcpu_count": 1, "mem_size_mib": 512}'

Set boot source

curl --unix-socket /tmp/fc.sock -X PUT \
  "http://localhost/boot-source" \
  -d '{"kernel_image_path": "/path/to/vmlinux"}'

Add root drive

curl --unix-socket /tmp/fc.sock -X PUT \
  "http://localhost/drives/rootfs" \
  -d '{"drive_id": "rootfs", "path_on_host": "/path/to/rootfs.ext4"}'

Start VM

curl --unix-socket /tmp/fc.sock -X PUT \
  "http://localhost/actions" \
  -d '{"action_type": "InstanceStart"}'

Device Model

Firecracker implements a minimal set of devices:

Device	Type	Purpose
virtio-block	Storage	Root filesystem
virtio-net	Network	Optional network access
virtio-vsock	Communication	Host-guest communication
Serial console	I/O	Debug output

Memory Management

• Memory ballooning: Dynamically adjust guest memory
• Memory overcommit: Not supported (for security)
• Huge pages: Supported for performance

Configuration

Machine Config

Machine configuration

{
  "vcpu_count": 1,
  "mem_size_mib": 512,
  "smt": false
}

Parameter	Description	Default
vcpu_count	Number of virtual CPUs	1
mem_size_mib	Memory in MiB	128
smt	Simultaneous multi-threading	false

Boot Source

Boot source configuration

{
  "kernel_image_path": "/srv/firecracker/vmlinux",
  "boot_args": "console=ttyS0 reboot=k panic=1 pci=off root=/dev/vda rw"
}

Parameter	Description
kernel_image_path	Path to uncompressed Linux kernel
boot_args	Kernel command line arguments
initrd_path	Optional initrd/initramfs

Drive Configuration

Drive configuration

{
  "drive_id": "rootfs",
  "path_on_host": "/srv/firecracker/rootfs.ext4",
  "is_root_device": true,
  "is_read_only": false
}

Parameter	Description
drive_id	Unique identifier for the drive
path_on_host	Path to disk image on host
is_root_device	Whether this is the root partition
is_read_only	Read-only or read-write

Vsock Configuration

Vsock configuration

{
  "guest_cid": 3,
  "uds_path": "/tmp/fc-12345.vsock"
}

Parameter	Description
guest_cid	Context ID for guest (3+ for guests)
uds_path	Unix socket path for host-side access

VM Lifecycle

In Runner Codes

How We Use Firecracker

1. Start Firecracker process with API socket
2. Configure VM (1 vCPU, 512 MiB RAM)
3. Set boot source (Linux kernel)
4. Attach rootfs (language-specific image)
5. Configure vsock for communication
6. Start VM and wait for boot
7. Execute code via vsock
8. Shutdown VM when done

Code Example (Go)

Start Firecracker VM from Go

func (h *HostAgent) startVM() error {
    // Create Firecracker process
    cmd := exec.Command("firecracker",
        "--api-sock", h.apiSocketPath,
    )
    cmd.Start()

    // Configure machine
    h.setMachineConfig(MachineConfig{
        VCPUCount:  1,
        MemSizeMiB: 512,
        SMT:        false,
    })

    // Set boot source
    h.setBootSource(BootSource{
        KernelPath: h.kernelPath,
        BootArgs:   "console=ttyS0 reboot=k panic=1 pci=off root=/dev/vda rw",
    })

    // Add rootfs drive
    h.addDrive(Drive{
        DriveID:      "rootfs",
        PathOnHost:   h.rootfsPath,
        IsRootDevice: true,
        IsReadOnly:   false,
    })

    // Configure vsock
    h.setVsock(Vsock{
        GuestCID: 3,
        UDSPath:  h.vsockPath,
    })

    // Start VM
    h.instanceStart()

    return nil
}

Requirements

Hardware

• CPU: Intel VT-x or AMD-V support
• Memory: Enough for host + all VMs
• Storage: SSD recommended for rootfs images

Software

• Linux kernel 4.14+: With KVM support
• KVM module: /dev/kvm accessible
• vhost_vsock module: /dev/vhost-vsock accessible

Checking Requirements

Check KVM

ls -la /dev/kvm

Check vhost_vsock

ls -la /dev/vhost-vsock

Load modules if missing

sudo modprobe kvm
sudo modprobe kvm_intel  # or kvm_amd
sudo modprobe vhost_vsock

Security

Security Features

Minimal Device Model

• Only essential devices are emulated, reducing attack surface

Seccomp Filters

• System call filtering limits what Firecracker can do

Jailer Process

• Additional isolation with chroot and dropped capabilities

No Network by Default

• VMs don't have network access unless explicitly configured

Production Hardening

For production use, enable the Jailer:

Run Firecracker with Jailer

jailer --id my-vm \
    --exec-file /usr/bin/firecracker \
    --uid 1000 --gid 1000 \
    --chroot-base-dir /srv/jailer \
    --daemonize

Performance Tuning

Boot Time Optimization

1. Use uncompressed kernel: Faster to load
2. Minimize rootfs: Only include necessary packages
3. Pre-warm VMs: Use snapshot restore for hot paths

Memory Optimization

1. Right-size VMs: Don't over-provision memory
2. Use huge pages: Reduces TLB misses
3. Enable KSM: Kernel Same-page Merging (for similar VMs)

CPU Optimization

1. Pin vCPUs: Improve cache locality
2. Disable SMT: Mitigate side-channel attacks
3. Set CPU template: Normalize CPU features

Resources

• Firecracker GitHub
• Firecracker Documentation
• Firecracker API Specification
• Production Deployment Guide