firecracker-microvm.github.io

Harden the host against a misbehaving Firecracker balloon (best-effort memory model)

Enable deflate_on_oom on a Firecracker balloon so guest OOM reclaims balloon pages instead of killing processes

Read Firecracker balloon statistics to monitor guest memory pressure

Inflate or deflate a running Firecracker balloon to reclaim or return guest memory

Configure a Firecracker virtio balloon device before boot with PUT /balloon

Verify a Firecracker binary is jailer-compatible (static musl build, same version) before launch

Run a jailer-launched Firecracker microVM in its own PID namespace with --new-pid-ns

Place a jailer-launched Firecracker microVM inside an existing network namespace

Set resource limits on a jailer-launched Firecracker microVM with --resource-limit

Pin a jailer-launched Firecracker microVM to a nested cgroup v2 hierarchy

Daemonize a jailer-launched Firecracker microVM so it detaches from the terminal

Launch a Firecracker microVM through the jailer with chroot isolation, dropping to an unprivileged uid/gid

Place a jailer-launched Firecracker microVM inside an existing network namespace

Set resource limits on a jailer-launched Firecracker microVM with --resource-limit

Pin a jailer-launched Firecracker microVM to a nested cgroup v2 hierarchy

Daemonize a jailer-launched Firecracker microVM so it detaches from the terminal

Launch a Firecracker microVM through the jailer with chroot isolation, dropping to an unprivileged uid/gid

Launch a Firecracker microVM through the jailer with chroot isolation, dropping to an unprivileged uid/gid

Set up a Firecracker vsock device and proxy host<->guest connections over a Unix socket

Restore a Firecracker snapshot with network and vsock backing overrides (PUT /snapshot/load)

Create a diff (incremental) snapshot of a Firecracker microVM using dirty-page tracking

Live-inflate/deflate a Firecracker microVM balloon to tune guest memory at runtime (PATCH /balloon)

Start Firecracker from a config file through the jailer (forward arguments after '--')

Join an existing network namespace when jailing a Firecracker microVM (--netns)

Place a jailed Firecracker microVM's cgroup in a nested parent hierarchy (--parent-cgroup)

Limit a jailed Firecracker microVM's open file descriptors and file size with --resource-limit

Configure the Firecracker jailer to place the microVM in a cgroup v2 hierarchy (--cgroup-version 2)

Pin a jailed Firecracker microVM's vCPUs/memory to specific CPUs and NUMA nodes via cgroup

Run a jailed Firecracker microVM inside a new PID namespace (--new-pid-ns) and find its PID

Daemonize a Firecracker microVM in the background with the jailer (setsid, stdio detached)

Configure the T2S static CPU template to allow secure snapshot migration of a Firecracker microVM between Intel Skylake and Cascade Lake hosts

Use a Firecracker custom CPU template to homogenize a heterogeneous fleet so all guests see an identical CPU feature set

Apply a custom Firecracker CPU template via /cpu-config to mask a specific x86_64 CPUID feature bit from the guest

Select the right Firecracker static CPU template (C3/T2/T2A/T2CL/T2S) for your host CPU family when homogenizing a heterogeneous fleet

Debug why a Firecracker custom CPU template seems applied but the guest gets unexpected CPU features

Configure Firecracker machine-config with a static CPU template and correct vcpu/mem for a serverless workload

Retrieve and reuse a Firecracker CPU template JSON with the cpu-template-helper tool to inspect or port guest CPU configuration

Configure a custom Firecracker CPU template on aarch64 (ARM) using reg_modifiers and vcpu_features

Use a Firecracker custom CPU template to mask an MSR (x86_64) so the guest sees a cleared model-specific register state

Set Firecracker KVM capabilities requirements (and negations) inside a custom CPU template to gate boot on specific KVM_CAP features

Read and inspect the currently-applied Firecracker CPU configuration (machine-config and cpu-config) on a running microVM

Deprecate a static Firecracker CPU template (C3/T2) and migrate to an equivalent custom /cpu-config template

Configure the T2S static CPU template to allow secure snapshot migration of a Firecracker microVM between Intel Skylake and Cascade Lake hosts

Use a Firecracker custom CPU template to homogenize a heterogeneous fleet so all guests see an identical CPU feature set

Apply a custom Firecracker CPU template via /cpu-config to mask a specific x86_64 CPUID feature bit from the guest

Select the right Firecracker static CPU template (C3/T2/T2A/T2CL/T2S) for your host CPU family when homogenizing a heterogeneous fleet

Use a Firecracker custom CPU template to homogenize a heterogeneous fleet so all guests see an identical CPU feature set

Apply a custom Firecracker CPU template via /cpu-config to mask a specific x86_64 CPUID feature bit from the guest

Select the right Firecracker static CPU template (C3/T2/T2A/T2CL/T2S) for your host CPU family when homogenizing a heterogeneous fleet

Expose a read-only host file/partition to a Firecracker microVM with the virtio-pmem device (persistent memory), including snapshot-coherent usage

Understand which devices each Firecracker API endpoint depends on (device-requirement matrix) to avoid 400 BadRequest on boot

Hotplug a virtio-block device onto a running Firecracker microVM (PCI) and rescan the guest bus to make it appear without rebooting

Use the Firecracker balloon with deflate_on_oom and free-page-reporting to safely overcommit and reclaim idle guest memory

Add or remove memory to a running Firecracker microVM dynamically with the virtio-mem device (memory hotplug)

Build and apply a custom Firecracker CPU template via /cpu-config (CPUID/MSR/register modifiers) for fine-grained vCPU feature control

Choose a Firecracker static CPU template (/machine-config cpu_template) to present a homogeneous feature set and enable cross-host snapshot migration

Attach additional read-only or read-write block drives to a Firecracker microVM beyond the root device

Attach multiple network interfaces (multiple TAPs) to a single Firecracker microVM and control guest-side device naming

Attach the Firecracker entropy device (virtio-rng) to give the guest high-quality randomness and expose /dev/hwrng, with optional rate limiting

Collect and interpret Firecracker balloon statistics (/balloon/statistics) to detect guest memory pressure before reclaiming or adding memory

Configure per-device token-bucket rate limiters on Firecracker virtio-net (rx/tx) and virtio-block (ops and bandwidth) to cap guest I/O

Start a Firecracker microVM reproducibly from a JSON config file with --config-file

Give a Firecracker microVM outbound network access through a host TAP interface with NAT

Tune Firecracker microVM machine configuration: vCPU count, memory, SMT, and dirty-page tracking

Inject guest configuration via the Firecracker microVM Metadata Service (MMDS) over 169.254.169.254

Take incremental (diff) Firecracker snapshots and rebase them onto a base

Take and restore a full snapshot of a running Firecracker microVM for fast cold-start

Reclaim and return guest memory in a Firecracker microVM with the virtio balloon device

Boot a Firecracker microVM from a kernel and root filesystem via the Firecracker API (boot-source, drives, network, InstanceStart)

Boot a Firecracker microVM from a kernel and root filesystem via the Firecracker API (boot-source, drives, network, InstanceStart)

Configure Firecracker metrics to a file or FIFO and tag lines with instance id and custom properties

Configure Firecracker logging to a file or named pipe with the single Logger

Understand and harden Firecracker seccomp: default BPF filters vs custom --seccomp-filter

Harden a Firecracker microVM with the jailer (chroot + cgroups + joined netns + dropped privileges)

Boot a Firecracker microVM from a kernel and root filesystem via the Firecracker API (boot-source, drives, network, InstanceStart)

Configure Firecracker metrics to a file or FIFO and tag lines with instance id and custom properties

Configure Firecracker logging to a file or named pipe with the single Logger

Understand and harden Firecracker seccomp: default BPF filters vs custom --seccomp-filter

Harden a Firecracker microVM with the jailer (chroot + cgroups + joined netns + dropped privileges)

Boot a Firecracker microVM from a kernel and root filesystem via the Firecracker API (boot-source, drives, network, InstanceStart)

Snapshot and restore a Firecracker microVM to enable fast cold-start of sandboxes

Set up host-to-guest and guest-to-host communication in a Firecracker microVM over virtio-vsock

Boot a Firecracker microVM via the REST API to isolate untrusted code (kernel, rootfs, network, InstanceStart)