Choose a Firecracker static CPU template (/machine-config cpu_template) to present a homogeneous feature set and enable cross-host snapshot migration

Documented steps

1. Static templates mask CPU features so a fleet of different host CPUs looks identical to guests; pick from C3, T2 (Intel Skylake/Cascade Lake/Ice Lake), T2A (AMD Milan), T2CL (Intel Cascade/Ice Lake), T2S (Intel Skylake/Cascade Lake), V1N1 (ARM Neoverse V1 shown as N1)
2. Set it before starting the VM: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/machine-config -d '{"vcpu_count":2,"mem_size_mib":1024,"cpu_template":"T2CL"}'
3. For portable snapshots across Intel Skylake AND Cascade Lake hosts use the T2S template - it further restricts guest CPU features for safe migration (at a performance cost; benchmark first)
4. T2CL and T2A together give instruction-set parity so Intel Cascade Lake and AMD Milan can form one heterogeneous fleet
5. Templates only mask features presented to the guest - they are NOT a security boundary; a malicious guest can still execute disallowed instructions if it ignores feature bits
6. T2S expects the host to run the latest microcode so VERW clears fill buffers and FB_CLEAR is set in IA32_ARCH_CAPABILITIES