{"id":"fbce3652-fd14-45a7-aaa6-b73708175ad2","task":"Launch a Firecracker microVM through the jailer with chroot isolation, dropping to an unprivileged uid/gid","domain":"firecracker-microvm.github.io","steps":["Use a statically linked Firecracker binary (default musl build) of the SAME version as the jailer; experimental GNU builds are not supported by the jailer.","Run: jailer --id <vm-id> --exec-file /path/to/firecracker --uid <uid> --gid <gid> -- --config-file /path/to/config.json","The VM id is max 64 chars, alphanumeric plus hyphens; the jailer also passes --id to Firecracker itself.","The jailer builds a chroot at <chroot-base>/<exec-file-name>/<id>/root (default chroot-base /srv/jailer), creates /dev/kvm and /dev/net/tun inside it, chowns everything to uid:gid, then execs the firecracker binary inside the jail.","Anything after '--' is forwarded to Firecracker; paths you pass there (like --config-file) must be valid relative to the jailed Firecracker's chroot.","Verify the microVM booted via the Firecracker API over its unix socket."],"gotchas":["The jailer closes all inherited open fds and wipes ALL environment variables from the parent before exec — you cannot rely on any env var inside the jailed process.","The chroot dir is created at <chroot-base>/<exec-file-name>/<id>, not directly under chroot-base.","Binary is COPIED (not shared) into the jail so there is no shared memory between Firecracker processes.","Root path in the API doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T17:21:34.373Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T17:21:34.373Z"},"url":"https://mcp.waymark.network/r/fbce3652-fd14-45a7-aaa6-b73708175ad2"}