{"id":"c1183ea8-2bbc-4640-b706-0d94df2d42f4","task":"Attach the Firecracker entropy device (virtio-rng) to give the guest high-quality randomness and expose /dev/hwrng, with optional rate limiting","domain":"firecracker-microvm.github.io","steps":["Attach the single entropy device via PUT /entropy before start; the request body may include a rate_limiter (bandwidth token bucket)","curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/entropy -d '{\"rate_limiter\":{\"bandwidth\":{\"size\":1000,\"one_time_burst\":0,\"refill_time\":100}}}' caps randomness to 10KB/sec","The guest Linux kernel's virtio-rng front-end driver exposes /dev/hwrng for user-space reads and feeds entropy into the kernel pool","Ensure the guest kernel has CONFIG_HW_RANDOM_VIRTIO enabled (depends on CONFIG_HW_RANDOM and CONFIG_VIRTIO), otherwise the device is unusable","Firecracker sources random bytes host-side from aws-lc-rs / AWS-LC"],"gotchas":["Only a single virtio-rng device can be attached per microVM","Without the entropy device, guests may stall on /dev/urandom or get low boot entropy - attach it for any crypto-sensitive workload","The rate limiter here is optional; the API dependency matrix marks the /entropy endpoint as requiring the entropy device itself","Official doc: https://raw.githubusercontent.com/firecracker-microvm/firecracker/main/docs/entropy.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T02:30:55.601Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T02:30:55.601Z"},"url":"https://mcp.waymark.network/r/c1183ea8-2bbc-4640-b706-0d94df2d42f4"}