HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
firecracker-microvm
firecracker
Rust2018–2026
firecracker-microvm / firecracker

firecracker

Secure and fast microVMs for serverless computing.

Systems & InfrastructureSecurity & PrivacyDevOps & Cloud
Explore on GitHubRead Hacker News discussions
84Distinct people
102Mentions
0Explicit recommenders
38KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Secure and fast microVMs for serverless computing.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 6:01:08 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year102 dated mentions

Observed mentions: 2018-11-27 05:00:35 UTC to 2026-09-30 23:40:36 UTC.

01020302018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 6 mentions; 2 submissions, 4 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 10 mentions; 0 submissions, 10 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 14 mentions; 0 submissions, 14 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 27 mentions; 4 submissions, 23 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 10 mentions; 2 submissions, 8 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 15 mentions; 0 submissions, 15 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 7 mentions; 3 submissions, 4 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 9 mentions; 0 submissions, 9 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC413
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC624
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC10010
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC14014
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC27423
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC1028
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC15015
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC734
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC909

What Hacker News says

27 sources
eyberg·Oct 18, 2022
Firecracker trades run-time performance in favor of faster boot-time latency. It is something that is being addressed but afaik still exists. This of course doesn't mean anything if you want firecracker to boot a multi-gig JVM installation (the larger the filesystem generally, expect a longer boot time). Security wise there are some minor differences. For instance bhyve supports virtio-rng but firecracker doesn't want to: https://github.com/firecracker-microvm/firecracker/issues/16... . I think if your app requires fast boot time and your app supports that than it's fine (so services that spin up and down on demand) but apps that daemonize for extended periods of time or take forever to initialize probably not a great fit.
In The FreeBSD/Firecracker Platform
0xbadcafebee·Sep 27, 2022
> All serverside cloud-style VMs get tap devices Unless you want to PCI pass-through an SRIOV VF into a guest? If you're paying out the ass for Cisco cloud gear you probably want the guest to have direct access to a card... Again, I don't remember the specifics, but depending on the underlying networking (on the host etc), there may be some issues with IPSec (but I could be wrong). From some random searching: https://linux-ipsec.org/wp-content/uploads/slides/2018/quest... > SANs work fine from within VMs. The point of a SAN is that the disk isn't attached. Firecracker talks to host block devices the same way other virtualizers do. But you may want to talk to an attached HBA? Firecracker's docs (https://github.com/firecracker-microvm/firecracker/blob/main...) say: "Firecracker emulated block devices are backed by files on the host. To be a
Read the rest
ble to mount block devices in the guest, the backing files need to be pre-formatted with a filesystem that the guest kernel supports." Based on everything else in the Firecracker docs, I don't see any vHBA support provided, so the guest cannot access an HBA on the host. And a virtual device backed by a file is going to have crap performance.
In Ignite – Use Firecracker VMs with Docker images
0xbadcafebee·Sep 27, 2022
I don't have direct experience with any of this, but just to hypothesize: - Firecracker/KVM can introduce some CPU overhead, for which there are some workarounds (https://github.com/firecracker-microvm/firecracker/blob/main...) - Firecracker networking uses a tap device. Want any kind of advanced networking hardware, say, to offload packet processing, do network inspection, etc, and access it from the containerized app? Not gonna work... IPSec/IKE VPN? May not work (iirc this requires some specific paravirt features? I might be misremembering). Have some advanced network controller that transparently handles mesh networks, or some other fancy shmancy system designed to manage complex interactions between containers and networks? Probably not gonna work due to assumptions about what lies between the layers, what components use what tricks
Read the rest
to handle advanced routing (Netfilter, eBGP, sidecars, etc). To say nothing of link-level differences (what if your network isn't Ethernet?). And all traffic is copied from an I/O thread of an emulated network device to a host TAP device, before it makes it to the real device; my guess is network latency and maximum PPS were not a priority. - The exposed CPU is based on what KVM supports exposing to guests; presumably QEMU supports a much wider selection. Clocksources, of which I know absolutely nothing (:D), are only allowed as kvm-clock. - All I/O is rate-limited by a custom scheme built by the Firecracker authors. I'm sure this is fine for most use-cases, but some weird high-performance outlier is gonna hit some sort of bottleneck with this thing I'm sure. - Firecracker emulated block devices are backed by files on the host. Ergo, any app that wants to control a disk directly, or use some fancy shmancy SAN directly, etc is out of luck. - The guest requires a balloon driver to use balloon support, which means the guest needs this special software, and compromising the guest driver could be a serious issue. I don't know if Kata does this differently. - Aarch64 support has a bunch of errata currently, so x86_64 is the only fully-supported platform; I dunno if Kata does any better, but this is a real hardware limitation, esp. if you're trying to buy a shit-ton of cheap powerful machines. - This is not hardware-specific, but Firecracker seems limited to specific kernel releases; right now the latest it supports is 5.10, according to https://github.com/firecracker-microvm/firecracker/blob/main... They emphasize that they want your host and guest to run "a supported kernel", even if it's possible to run different ones. To me that says that there's the potential for Firecracker-specific bugs in newer (or older?) guest kernels. From that page: "Firecracker represents a component in a larger stack, one in which it is tightly coupled with the guest and host kernels on which it is run." I would add that containers are used in far more settings than server-side, and would be great to have on the edge, in IoT, and on desktops, if they were a little less... funky. In general, containers requires a lot of extra steps to be "usable" as general purpose applications, and access to hardware will absolutely be a barrier we need to cross in order for "general purpose containerized apps" to become commonplace.
In Ignite – Use Firecracker VMs with Docker images
topspin·Sep 27, 2022
> If it's not hard to name a thing that Firecracker makes difficult for a serverside workload, could you... name one? I already did that with live migration. But ok. Encrypted storage: https://github.com/firecracker-microvm/firecracker/issues/65...: WONTFIX The answer given is appropriate for firecracker use cases but insufficient otherwise. I'm not anti-firecracker; it's the right choice for many things. Just not all things. The sort of VM I want orchestrated has encrypted (by contract) multi-pathed network block devices to encrypted storage volumes. 3-10 per tenant. This is trivial for a full-featured kernel; multi-path just works, encryption just works. VLAN: https://github.com/weaveworks/ignite/issues/810: Open. Maybe one day. Again, trivial for a full-featured Linux kernel. Has been for ages. I think you're missing the point.
Read the rest
It's not about what hypothetical thing firecracker can or can't do. It's about elevating VM orchestration to some degree of parity with what has been created for container orchestration. These VMs and their complex storage and networking requirements should be modeled as we model containers now; through an orchestration system that makes management easy and as foolproof as possible. The fact that firecracker isn't sufficient to be the Micro-VM of choice for this isn't relevant.
In Ignite – Use Firecracker VMs with Docker images
maccam94·Sep 21, 2022
The Firefox repo is 27% C++, 14% C, and 9.5% Rust - https://4e6.github.io/firefox-lang-stats/ AWS wrote Firecracker which powers AWS Lamba - https://github.com/firecracker-microvm/firecracker Cloudflare just replaced nginx with an in-house reverse proxy written in Rust called Pingora (not yet open source) Facebook rewrote Mercurial in Rust to help scale their monorepo (called Mononoke, now part of their EdenSCM project) Dropbox rewrote their sync client in Rust, and they wrote their block storage service (Magic Pocket) in it. A significant portion of Google's new Fuchsia OS is written in Rust, and it is currently powering Nest devices NPM's backend is written in rust curl can now use Rust's hyper library for making http requests
In Next steps for Rust in the kernel
kris-nova·Sep 18, 2022
This is a good call out. One of the philosophies of the project I am trying to maintain is instilling my opinion into things while still having the project play nice with the rest of the ecosystem. On one hand I over-engineer a systemd hypervisor that is only meaningful to me. On the hand I create another ambiguous junk drawer that is meaningless without a team of experts to tell you how to configure everything. I think having what kubernetes calls "namespaces" as an isolation boundary on each node running as a VM is the move here. It SHOULD run like this as a default. Pods are another story. Namespaces however -- should always have a VM boundary. Getting the network device integration is going to be a big thing here. I suspect this means each namespace now has 1 or more NICs it will be able to leverage. Firecracker went with the bridge m
Read the rest
entality which I kind of disagree with: https://github.com/firecracker-microvm/firecracker/blob/main... I want to see tools like Tailscale that leverage network devices as the "true network interface" find value in the guest namespace paradigm. Hope this helps!
In Why Fix Kubernetes and Systemd?
alexellisuk·Sep 2, 2022
This is really cool. I've also been working with Firecracker, but for isolated CI runners with Docker and KinD/K3s support. Starting with GitHub Actions [1] I've also had interest in making OpenFaaS use pause/resume from Gatsby.js who wanted to reduce their hosting costs. The main challenges were around the networking - if you use CNI and the Go SDK [2] then restores simply don't work. Not sure if you're working with netlink and IMAP directly to get around it? My question is how are you guaranteeing uniqueness, or do you only clone snapshots for a single tenant? [3] [1] https://github.com/self-actuated/actuated [2] https://github.com/firecracker-microvm/firecracker-go-sdk [3] https://github.com/firecracker-microvm/firecracker/blob/main...
In We clone a running VM in 2 seconds
CompuIves·Sep 2, 2022
Firecracker keeps a bitmap of which pages have been dirtied (it's a flag you can turn on), so you can make incremental snapshots of only the changed pages (more here: https://github.com/firecracker-microvm/firecracker/blob/main...). In our case we changed Firecracker to use a shared mmap instead of an private mmap, so in our case the dirtied pages were synced back automatically to the backing memory file. The main reason for this was to reduce IO on snapshot time. I'm also looking at other ways we can do this, because using a shared mmap fragments the underlying xfs fs pretty fast. Maybe we can batch writes more instead of writing single pages.
In We clone a running VM in 2 seconds

Showing the 15 most recent of 27 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.