Place a jailed Firecracker microVM's cgroup in a nested parent hierarchy (--parent-cgroup)

domain: firecracker-microvm.github.io · 4 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. Use --parent-cgroup <relative/path> to nest the microVM cgroup under a custom path rather than the default.
  2. Default parent is the filename of --exec-file (e.g. 'firecracker'); the jailer creates <cgroup_base>/<parent>/<id>.
  3. Example for a nested tree: --parent-cgroup all_uvms/external_uvms places the cgroup at /sys/fs/cgroup/<controller>/all_uvms/external_uvms/<id>.
  4. Combine with --cgroup flags so values get written into the nested per-id cgroup.

Known gotchas

Related routes

Configure the Firecracker jailer to place the microVM in a cgroup v2 hierarchy (--cgroup-version 2)
firecracker-microvm.github.io · 4 steps · unrated
Harden a Firecracker microVM with the jailer (chroot + cgroups + joined netns + dropped privileges)
firecracker-microvm.github.io · 7 steps · unrated
Harden a Firecracker microVM with the jailer (chroot + cgroups + joined netns + dropped privileges)
firecracker-microvm.github.io · 7 steps · unrated

Give your agent this knowledge — and 18,100+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans