Firecracker
lastmod 2023-03-09created 2021-10-248 edits
Announcing an open-source lightweight virtualization technology for serverless computing
Secure and fast microVMs for serverless computing.
Introducing Firecracker
Today I would like to introduce Firecracker, a new virtualization technology that uses KVM. With Firecracker, you can launch lightweight microVMs (micro virtual machines) in non-virtualized environments in less than a second, and take advantage of the resource efficiency provided by containers together with the workload isolation and security benefits of traditional VMs.
Here is what you need to know about Firecracker.
- Security – Always the top priority! Firecracker uses multiple levels of isolation and protection and minimizes the attack surface.
- High performance – As of now, a microVM can be launched within 125 milliseconds (expected to get faster in 2019), making it suitable for many types of workloads, including short-lived or transient workloads.
- Proven track record – Firecracker is battle-tested. Many high-volume AWS services, including AWS Lambda and AWS Fargate, already use Firecracker.
- Low overhead – Firecracker uses about 5 MiB of memory per microVM. You can also run thousands of secure VMs with varying vCPU and memory configurations on the same instance.
- Open source – Firecracker is an active open-source project. We are already ready to accept reviews and PRs (Pull Requests), and look forward to collaborating with contributors around the world.
Firecracker was built with minimalism in mind. Starting from crosvm, we set up a minimal device model to reduce overhead and enable secure multi-tenancy. Firecracker is written in Rust, a modern programming language that guarantees thread safety and prevents many types of buffer overrun errors that can lead to security vulnerabilities.
Firecracker security
As mentioned above, Firecracker integrates many security features! Here are a few of them.
- Simple guest model – Firecracker guests are presented with a simple virtualized device model to minimize the attack surface (e.g., network device, block I/O device, PIT (Programmable Interval Timer), KVM clock, serial console, and a partial keyboard (just enough to reset the VM)).
- Jail – The Firecracker process is jailed using cgroups and seccomp BPF and has access to a very limited, small list of system calls.
- Static linking – The firecracker process is statically linked and is launched from the jailer to ensure a host environment that is as safe and clean as possible.