Run a Firecracker microVM under the jailer binary with chroot isolation, an unprivileged uid/gid, and optional network-namespace joining

Documented steps

1. Use a jailer binary with a statically linked (musl) Firecracker binary of the SAME version — the jailer is designed only for Firecracker, and experimental gnu builds are not supported.
2. Invoke as root: `jailer --id <id> --exec-file /usr/bin/firecracker --uid <uid> --gid <gid> [--chroot-base-dir <base>] [--netns /var/run/netns/<ns>]`. `--id` is a unique VM id of alphanumerics and hyphens, max 64 chars. `--chroot-base-dir` defaults to /srv/jailer.
3. The jailer creates the chroot at `<chroot_base>/<exec_file_name>/<id>/root` (referred to as <chroot_dir>), copies the exec-file into it, mknods /dev/net/tun and /dev/kvm equivalents inside the jail, chowns them and <chroot_dir> to <uid>:<gid>, then pivot_root+chroots, drops privileges, and execs `./firecracker --id=<id> --start-time-us=... --start-time-cpu-us=...`.
4. Hard link or copy every resource the VM will need via the API (kernel image, disk images, named pipes) INTO the jail root folder before referencing them; the Firecracker user needs read AND write permissions on backing files for read-write block devices.
5. Arguments after `--` are forwarded to Firecracker (end-of-options convention), e.g. pair with Firecracker's `--config-file` using paths valid relative to the jail. Do not pass `--id` yourself — the jailer already forwards it.
6. Talk to the API socket at `<chroot_dir>/run/firecracker.socket` (the default <api-sock> is /run/firecracker.socket, created inside the jail): `curl --unix-socket <chroot_dir>/run/firecracker.socket http://localhost/`.
7. Optionally bound process resources with repeatable `--resource-limit <resource>=<value>` (supported: `fsize`, `no-file`), e.g. `--resource-limit fsize=250000000 --resource-limit no-file=1024`.
8. Official doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md