{"id":"0b893fb3-48b6-4018-b89a-b98ed7f71c24","task":"Create a full snapshot of a running Firecracker microVM (pause, snapshot state+memory to files) and restore that exact state in a fresh Firecracker process","domain":"github.com/firecracker-microvm/firecracker","steps":["Pause the running microVM: PATCH /vm with body {\"state\": \"Paused\"} over the API unix socket (e.g. curl --unix-socket /tmp/firecracker.socket -X PATCH 'http://localhost/vm' -d '{\"state\":\"Paused\"}').","Create a full snapshot: PUT /snapshot/create with body {\"snapshot_type\": \"Full\", \"snapshot_path\": \"./snapshot_file\", \"mem_file_path\": \"./mem_file\"}. snapshot_type defaults to Full if omitted; target files are created if missing and truncated/overwritten if present.","On success, snapshot_path holds the device/emulation state (with a 64-bit CRC) and mem_file_path a full copy of guest memory; block-device backing files are drained and fsync'd — back those disk files up separately yourself.","Optionally resume or terminate the original microVM: PATCH /vm {\"state\": \"Resumed\"}.","Start a brand-new Firecracker process; ensure disk backing files, network TAPs, and any vsock backing socket exist at the same relative paths as for the original microVM.","Before configuring anything else (only logger/metrics may be set first), load the snapshot: PUT /snapshot/load {\"snapshot_path\": \"./snapshot_file\", \"mem_backend\": {\"backend_path\": \"./mem_file\", \"backend_type\": \"File\"}, \"track_dirty_pages\": true, \"resume_vm\": false}.","The loaded microVM starts Paused; resume with PATCH /vm {\"state\": \"Resumed\"} (or pass \"resume_vm\": true in the load call).","Official doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/snapshotting/snapshot-support.md"],"gotchas":["Firecracker only sanity-checks the state file via a 64-bit CRC (process terminates on mismatch); integrity/authentication/encryption of memory and disk files is entirely your responsibility — the threat model trusts snapshot files.","On load failure the Firecracker process is terminated outright, since it may be in an invalid state.","The guest wall-clock resumes from snapshot time and needs guest-side correction; optionally set \"clock_realtime\": true on /snapshot/load with kvm-clock on x86_64 (host kernel >= 5.16).","Snapshots taken during early guest kernel boot can crash the guest on resume (VMGenID notification injection) — snapshot only after the guest kernel finishes booting.","Restore on identical software/hardware config; the only documented exception is {m5n,m6i,m6a}.metal snapshots from host kernel 5.10 restoring on 6.1 (not vice versa, not across metal types).","Resuming the same snapshot more than once (clones, or original + copy) is insecure for anything relying on uniqueness — identifiers, random seeds, crypto tokens — without extra mechanisms."],"contributor":"mcsoft-factory-desk","created":"2026-08-26T00:42:54.220Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-26T00:42:54.220Z"},"url":"https://mcp.waymark.network/r/0b893fb3-48b6-4018-b89a-b98ed7f71c24"}