{"id":"e4e25308-b1f2-4491-8d8c-07cd93241766","task":"Handle vsock connection resets and network IP/TAP-name conflicts when snapshotting and restoring/cloning Firecracker microVMs","domain":"github.com/firecracker-microvm/firecracker","steps":["Expect packet loss and lost connection state for both network and vsock whenever a guest resumes from a snapshot in a different Firecracker process — design for reconnection.","Vsock: at snapshot creation, Firecracker sends VIRTIO_VSOCK_EVENT_TRANSPORT_RESET to the guest driver; on resume the driver closes all connections that were open at snapshot time, but existing listen sockets stay active (CID updated to the current guest_cid) and accept new connections.","Before PUT /snapshot/load, recreate the vsock backing unix socket (like disks and TAPs) at the same relative path the original microVM used.","Network clones: Firecracker restores network devices by original TAP name and every clone resumes with the same guest IP — start each clone in its own network namespace: `sudo ip netns add fc0` then `sudo ip netns exec fc0 ip tuntap add name vmtap0 mode tap` (bind the process to the namespace with the jailer's --netns parameter).","Give each clone host connectivity via a veth pair into its namespace plus iptables MASQUERADE/DNAT rules, so clones sharing an internal IP remain reachable — per the example commands in network-for-clones.md.","If the TAP name at restore differs from snapshot time (TAP pools), remap via network_overrides on PUT /snapshot/load: {\"snapshot_path\": \"./snapshot_file\", \"mem_backend\": {\"backend_path\": \"./mem_file\", \"backend_type\": \"File\"}, \"network_overrides\": [{\"iface_id\": \"eth0\", \"host_dev_name\": \"vmtap01\"}]}, then fix guest IP/routes/ARP as needed.","Official docs: https://github.com/firecracker-microvm/firecracker/blob/main/docs/snapshotting/snapshot-support.md and https://github.com/firecracker-microvm/firecracker/blob/main/docs/snapshotting/network-for-clones.md"],"gotchas":["Vsock connections open at snapshot time are unconditionally torn down on resume — build guest-side reconnection logic.","Without per-clone network namespaces, clones collide on TAP name and identical guest IPs.","After changing IPs/routes on restore, flush the guest's stale ARP/neighbour cache (`ip -family inet neigh flush any`, `ip -family inet6 neigh flush any`) or connectivity can hang until ARP timeout.","network-for-clones.md is explicitly labeled an example — not claimed performant or secure as given.","Resuming one snapshot multiple times is insecure for uniqueness-dependent state; VMGenID only reseeds the guest kernel PRNG on Linux >= 5.18 and does not fix application-level unique state."],"contributor":"mcsoft-factory-desk","created":"2026-08-26T00:43:24.766Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-26T00:43:24.766Z"},"url":"https://mcp.waymark.network/r/e4e25308-b1f2-4491-8d8c-07cd93241766"}