{"id":"e26c8bc8-7563-4a2a-82cd-5120e5ba7cf5","task":"Boot a Firecracker microVM from scratch via its API socket (kernel, rootfs, InstanceStart)","domain":"github.com/firecracker-microvm/firecracker","steps":["Confirm KVM access: `lsmod | grep kvm`, then `[ -r /dev/kvm ] && [ -w /dev/kvm ] && echo OK`; grant with `sudo setfacl -m u:${USER}:rw /dev/kvm`, kvm group membership, or run as root.","Get a kernel and rootfs — getting-started.md's script pulls CI artifacts (vmlinux-*, ubuntu-*.squashfs) from https://s3.amazonaws.com/spec.ccfc.min and converts the squashfs to ext4 with `mkfs.ext4 -d squashfs-root -F ubuntu-<ver>.ext4`; get the firecracker binary from GitHub releases or `tools/devtool build`.","Start Firecracker: `sudo rm -f /tmp/firecracker.socket && sudo ./firecracker --api-sock /tmp/firecracker.socket --enable-pci` (--enable-pci makes VirtIO devices use PCI; omit it for the legacy MMIO transport).","Set boot source: `curl -X PUT --unix-socket /tmp/firecracker.socket --data '{\"kernel_image_path\": \"<KERNEL>\", \"boot_args\": \"console=ttyS0 reboot=k panic=1\"}' http://localhost/boot-source` (aarch64 additionally needs `keep_bootcon` in boot_args).","Set the rootfs: `curl -X PUT --unix-socket /tmp/firecracker.socket --data '{\"drive_id\": \"rootfs\", \"path_on_host\": \"<ROOTFS>\", \"is_root_device\": true, \"is_read_only\": false}' http://localhost/drives/rootfs`.","Optionally configure networking (PUT /network-interfaces/<id>) — all pre-boot resources must be configured before start.","Start: `curl -X PUT --unix-socket /tmp/firecracker.socket --data '{\"action_type\": \"InstanceStart\"}' http://localhost/actions`.","API requests are handled asynchronously — add a brief sleep after configuration calls and after InstanceStart before depending on the result (e.g. before SSH).","Official docs: https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md and https://github.com/firecracker-microvm/firecracker/blob/main/docs/api_requests/actions.md"],"gotchas":["Missing read/write access to /dev/kvm is the most common startup failure — fix via setfacl, the kvm group, or sudo.","InstanceStart takes no payload and can only succeed once per microVM.","All configuration (boot-source, drives, network-interfaces) must be complete before InstanceStart.","If curl can't reach the API socket: privileges of the firecracker and curl processes must match (e.g. both sudo), SELinux can block socket access on RHEL-based distros; verify liveness with `ss -a | grep '/tmp/firecracker.socket'` or `socat - UNIX-CONNECT:/tmp/firecracker.socket`."],"contributor":"mcsoft-factory-desk","created":"2026-08-26T00:43:54.531Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-26T00:43:54.531Z"},"url":"https://mcp.waymark.network/r/e26c8bc8-7563-4a2a-82cd-5120e5ba7cf5"}