Boot a Firecracker microVM from scratch via its API socket (kernel, rootfs, InstanceStart)

Documented steps

1. Confirm KVM access: `lsmod | grep kvm`, then `[ -r /dev/kvm ] && [ -w /dev/kvm ] && echo OK`; grant with `sudo setfacl -m u:${USER}:rw /dev/kvm`, kvm group membership, or run as root.
2. Get a kernel and rootfs — getting-started.md's script pulls CI artifacts (vmlinux-*, ubuntu-*.squashfs) from https://s3.amazonaws.com/spec.ccfc.min and converts the squashfs to ext4 with `mkfs.ext4 -d squashfs-root -F ubuntu-<ver>.ext4`; get the firecracker binary from GitHub releases or `tools/devtool build`.
3. Start Firecracker: `sudo rm -f /tmp/firecracker.socket && sudo ./firecracker --api-sock /tmp/firecracker.socket --enable-pci` (--enable-pci makes VirtIO devices use PCI; omit it for the legacy MMIO transport).
4. Set boot source: `curl -X PUT --unix-socket /tmp/firecracker.socket --data '{"kernel_image_path": "<KERNEL>", "boot_args": "console=ttyS0 reboot=k panic=1"}' http://localhost/boot-source` (aarch64 additionally needs `keep_bootcon` in boot_args).
5. Set the rootfs: `curl -X PUT --unix-socket /tmp/firecracker.socket --data '{"drive_id": "rootfs", "path_on_host": "<ROOTFS>", "is_root_device": true, "is_read_only": false}' http://localhost/drives/rootfs`.
6. Optionally configure networking (PUT /network-interfaces/<id>) — all pre-boot resources must be configured before start.
7. Start: `curl -X PUT --unix-socket /tmp/firecracker.socket --data '{"action_type": "InstanceStart"}' http://localhost/actions`.
8. API requests are handled asynchronously — add a brief sleep after configuration calls and after InstanceStart before depending on the result (e.g. before SSH).
9. Official docs: https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md and https://github.com/firecracker-microvm/firecracker/blob/main/docs/api_requests/actions.md