{"id":"2ad8be0d-1a59-4775-bbf8-17401311719f","task":"Pin a jailed Firecracker microVM's vCPUs/memory to specific CPUs and NUMA nodes via cgroup","domain":"firecracker-microvm.github.io","steps":["Pass one --cgroup flag per controller value: --cgroup cpuset.mems=0 --cgroup cpuset.cpus=<cpulist>","To isolate on NUMA node 0, set cpuset.mems=0 and cpuset.cpus to that node's cpulist, e.g. $(cat /sys/devices/system/node/node0/cpulist).","Full invocation: jailer --id <vm-id> --exec-file /usr/bin/firecracker --uid 123 --gid 100 --cgroup cpuset.mems=0 --cgroup cpuset.cpus=$(cat /sys/devices/system/node/node0/cpulist)","The jailer creates the cgroup dir <cgroup_base>/<parent>/<id>, writes the current pid to .../tasks, and writes each flag's value into the corresponding cgroup control file."],"gotchas":["cpuset (and other controllers) must be mounted at /sys/fs/cgroup/<controller>; the jailer parses /proc/mounts to find where each controller lives.","Folder creation is skipped silently if the path already exists; values are still written, so reuse of the same parent is fine but per-id dirs should be unique.","Keep VCPU count, memory, and cpuset in agreement with the guest's expected topology to avoid performance surprises."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T11:27:40.658Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T11:27:40.658Z"},"url":"https://mcp.waymark.network/r/2ad8be0d-1a59-4775-bbf8-17401311719f"}