{"id":"8e5f9875-0ba4-463c-92d3-e0f472a57acf","task":"Boot a Firecracker microVM via the REST API to isolate untrusted code (kernel, rootfs, network, InstanceStart)","domain":"firecracker-microvm.github.io","steps":["Ensure the host has KVM and your user can read/write /dev/kvm (e.g. sudo setfacl -m u:${USER}:rw /dev/kvm, add to the kvm group, or run as root)","Obtain an uncompressed Linux kernel binary and an ext4 rootfs image","Start the Firecracker binary with a control socket and PCI transport: sudo ./firecracker --api-sock /tmp/firecracker.socket --enable-pci","In a second terminal configure via the API with curl --unix-socket: PUT /boot-source (kernel + boot args like console=ttyS0 reboot=k panic=1), PUT /drives/rootfs (is_root_device:true), PUT /network-interfaces/net1, and set up a TAP device","Start the VM: PUT /actions with {\"action_type\":\"InstanceStart\"}; wait ~0.015s after config then ~2s before SSH"],"gotchas":["--enable-pci (VirtIO via PCI) is recommended over legacy MMIO for throughput and latency","/dev/kvm must be readable/writable by the running user - the most common first-run failure is a permission error on /dev/kvm","The API is HTTP over a unix socket; every config change is a PUT and InstanceStart completes asynchronously","For production, run through the jailer binary which applies a cgroup/namespace isolation barrier and drops privileges","Doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:37:39.497Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:37:39.497Z"},"url":"https://mcp.waymark.network/r/8e5f9875-0ba4-463c-92d3-e0f472a57acf"}