- Description:
- Firecracker with the chroot.dev fixes, branch chroot
- Last Change:
- Clone URL:
ssh://anon@got.v6.chroot.run/firecracker
- ED25519:
SHA256:7587EKj+viWIfWGzPGNqUFSdFEh83CZFaqnwaoNmcNc
Commit Briefs
vstate: bus: Test routing with multiple devices (ilstam-bar-reloc-01)
The Bus tests only ever exercise a single device, so nothing covers the range -> slot -> device indirection. A range bound to the wrong slot would route a guest MMIO access to the wrong device. Add a test with several devices that identify themselves in their read responses. It checks that every range decodes to its owner, that removing a device leaves its range undecoded without disturbing the others, that the freed slab slot is recycled by the next insertion, and that re-registering the freed range rebinds it to the new device. PR: https://github.com/firecracker-microvm/firecracker/pull/6111 Signed-off-by: Ilias Stamatis <ilstam@amazon.com>
vstate: bus: Decouple address ranges from device handles
The Bus structure keeps a single map from bus ranges to devices guarded by a RwLock. A device access (Bus::read()/Bus::write()) holds that lock for the entire duration of the access. That is deliberate: it makes Bus::remove() block until every in-flight access to a device has finished, so the device's last reference is dropped by the time remove() returns. The downside is that a device cannot change the bus from within its own access. A subsequent commit will add support for BAR relocation. BAR relocation needs exactly that: when the guest reprograms a BAR, the device has to move its own mapping on the mmio_bus, but the config-space access that triggers the move is already holding the bus lock, so taking the write lock to move the mapping would deadlock. Split the single map into two structures behind two locks, one mapping address -> slot and another one mapping slot -> device handle: - ranges: RwLock<BTreeMap<BusRange, slot>> - devices: RwLock<Slab<Weak<Mutex<dyn BusDevice>>>> A device access now holds only the `devices` read lock across the call, which still makes Bus::remove() wait for in-flight users, while moving a mapping only touches `ranges`. Since the access does not hold `ranges` while it calls into the device, the device can relocate its own mapping without deadlocking. Whenever both locks are taken they must be acquired in the same order, `devices` before `ranges`. PR: https://github.com/firecracker-microvm/firecracker/pull/6088 Signed-off-by: Ilias Stamatis <ilstam@amazon.com>
pci_mngr: Fix attach vs reset deadlock by releasing allocator lock early
attach_pci_virtio_device() binds the resource allocator lock to a local that lives until the end of the function, so it is still held across attach_common(), which inserts the device's BAR mapping into the mmio_bus. That is the resource allocator lock taken before the mmio_bus lock. Since the bus holds its read lock for the duration of a device access, a device access can take the two locks in the opposite order: a guest MMIO access that resets a virtio-pci device runs under the mmio_bus read lock and calls reset_msix() -> KvmVm::create_msix_group(), which allocates from the resource allocator. A device hotplug concurrent with a guest resetting an existing device therefore deadlocks (ABBA). Hold the resource allocator lock only for as long as allocating the BARs needs it, so it is released before any bus is touched. Fixes: 548d79224525 ("bus: hold the read lock during device accesses") PR: https://github.com/firecracker-microvm/firecracker/pull/6087 Signed-off-by: Ilias Stamatis <ilstam@amazon.com>
test(vuln): run spectre-meltdown-checker on Neoverse V3
Remove the Neoverse V3 skip: the checker recognises the CPU (MIDR part 0xd84) since speed47/spectre-meltdown-checker#583, which is included in the released build the tests now download. The Spectre v2 and Variant 3a false positives that motivated the skip no longer occur, and the one expected guest finding (ARM SSBS NOSYNC, erratum 3194386) is covered by the aarch64 entry in expected_vulnerabilities(). Signed-off-by: Jay Chung <jaehoc@amazon.com>
test(vuln): update expected guest checker findings
The latest checker performs several checks absent from the previously pinned version. A full-fleet validation run (11 instance types x 3 host kernels), comparing host vs guest verdicts per instance, showed these findings: - BPI (CVE-2024-45332) on Intel guests: like REPTAR, a microcode-only fix with no CPUID/MSR indicator, so the checker compares the microcode version Firecracker does not expose to guests. The host tests pass on the same hardware (for Cascade Lake, Intel confirmed microcode 0x5003901 as the mitigated release for CPUID 50657, and the checker's missing table row for it was fixed in speed47/spectre-meltdown-checker#584). Fires on all guest kernels. - MMIO Stale Data trio (SBDR/SBDS/DRPW) on Cascade Lake T2S guests on host kernels < 6.4: the template presents a Skylake CPU and the masked-off FLUSH_L1D bit routes the guest into the microcode-needed branch, same mechanism as the existing mmio_stale_data files-test exception. - INCEPTION (CVE-2023-20569) on AMD guests on host kernels < 6.7: KVM did not synthesize IBPB_BRTYPE before v6.7. The INFOS string is guest-version dependent (guests < 6.7 report a mitigation the checker overrides; sysfs reporting fixed in v6.7, torvalds/linux@dc6306ad5b0d). - ARM SSBS NOSYNC (erratum 3194386) on all Graviton guests: the CI guest kernels disable the workaround (ci.config) because it hides the ssbs hwcap the CPU-feature tests assert on, so the finding is accurate for the guest kernel; hosts carry the workaround and pass. Expected until the guest kernels re-enable it (tracked in test_cpu_features_host_vs_guest.py). Signed-off-by: Jay Chung <jaehoc@amazon.com>
test(vuln): unpin spectre-meltdown-checker
Restore tracking the latest released checker, reverting the emergency pin from #5810. The bugs that motivated the pin (speed47/spectre-meltdown-checker#527) are fixed upstream, and the pinned version predates the checks for several 2024/2025 CVEs. Two forced invocation changes come with the bump: - --no-intel-db was removed upstream and is now a fatal unknown option; the Intel DB is always consulted. - The bare JSON array format moved from --batch json to --batch json-terse; the output is byte-compatible with our parser. Signed-off-by: Jay Chung <jaehoc@amazon.com>
test(vsock): cover host-initiated connections after bare resume
Add an integration test that pauses and resumes a microVM without snapshotting and checks that fresh host-initiated (RX direction) connections still work afterwards, alongside guest-initiated ones. Signed-off-by: Dov Alperin <git@dov.dev>
fix(vsock): do not arm the TRANSPORT_RESET RX gate on bare resume
The resume kick unconditionally armed `pending_event_ack`, the gate that suppresses RX delivery until the guest acknowledges a TRANSPORT_RESET event. On a bare pause/resume no such event was ever published, so the guest could never acknowledge it, the gate never cleared, and every new host-initiated connection made after the resume hung forever. TX kept working, which made the failure look RX-specific. Persist `pending_event_ack` in the vsock frontend snapshot state and make the resume kick respect the restored value instead of arming it: the event queue is only re-signaled when a reset ack is actually outstanding, and a bare resume leaves RX untouched. Signed-off-by: Dov Alperin <git@dov.dev>
chore(deps): bump the firecracker group across 1 directory with 27 updates
Bumps the firecracker group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [displaydoc](https://github.com/yaahc/displaydoc) | `0.2.6` | `0.2.7` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.20` | | [zerocopy](https://github.com/google/zerocopy) | `0.8.55` | `0.8.56` | | [clap](https://github.com/clap-rs/clap) | `4.6.4` | `4.6.6` | | [micro_http](https://github.com/firecracker-microvm/micro-http) | ``876f3fe`` | ``7975fe0`` | | [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.17.3` | `1.18.0` | | [base64](https://github.com/marshallpierce/rust-base64) | `0.23.0` | `0.23.1` | | [aho-corasick](https://github.com/BurntSushi/aho-corasick) | `1.1.4` | `1.1.5` | | [cc](https://github.com/rust-lang/cc-rs) | `1.4.0` | `1.4.2` | | [clang-sys](https://github.com/KyleMayes/clang-sys) | `1.8.1` | `1.9.1` | | [getrandom](https://github.com/rust-random/getrandom) | `0.4.1` | `0.4.3` | | [glam](https://github.com/bitshifter/glam-rs) | `0.33.2` | `0.33.3` | | [js-sys](https://github.com/wasm-bindgen/wasm-bindgen) | `0.3.103` | `0.3.104` | | [rand](https://github.com/rust-random/rand) | `0.10.0` | `0.10.2` | | [rand_core](https://github.com/rust-random/rand_core) | `0.10.0` | `0.10.1` | | [regex-automata](https://github.com/rust-lang/regex) | `0.4.16` | `0.4.18` | | [toml](https://github.com/toml-rs/toml) | `1.1.3+spec-1.1.0` | `1.1.4+spec-1.1.0` | Updates `displaydoc` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/yaahc/displaydoc/blob/master/CHANGELOG.md) - [Commits](https://github.com/yaahc/displaydoc/compare/v0.2.6...v0.2.7) Updates `thiserror` from 2.0.19 to 2.0.20 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](https://github.com/dtolnay/thiserror/compare/2.0.19...2.0.20) Updates `zerocopy` from 0.8.55 to 0.8.56 - [Release notes](https://github.com/google/zerocopy/releases) - [Commits](https://github.com/google/zerocopy/compare/v0.8.55...v0.8.56) Updates `clap` from 4.6.4 to 4.6.6 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.4...clap_complete-v4.6.6) Updates `micro_http` from `876f3fe` to `7975fe0` - [Commits](https://github.com/firecracker-microvm/micro-http/compare/876f3feccc30e09225f2c77bf95a6b2d46a9259e...7975fe0e59000e8c41cb1d58fbd39ffa102e5b27) Updates `aws-lc-rs` from 1.17.3 to 1.18.0 - [Release notes](https://github.com/aws/aws-lc-rs/releases) - [Commits](https://github.com/aws/aws-lc-rs/compare/v1.17.3...v1.18.0) Updates `base64` from 0.23.0 to 0.23.1 - [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md) - [Commits](https://github.com/marshallpierce/rust-base64/compare/v0.23.0...v0.23.1) Updates `aho-corasick` from 1.1.4 to 1.1.5 - [Commits](https://github.com/BurntSushi/aho-corasick/compare/1.1.4...1.1.5) Updates `aws-lc-sys` from 0.43.0 to 0.44.0 - [Release notes](https://github.com/aws/aws-lc-rs/releases) - [Commits](https://github.com/aws/aws-lc-rs/compare/aws-lc-sys/v0.43.0...aws-lc-sys/v0.44.0) Updates `cc` from 1.4.0 to 1.4.2 - [Release notes](https://github.com/rust-lang/cc-rs/releases) - [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/cc-rs/compare/cc-v1.4.0...cc-v1.4.2) Updates `clang-sys` from 1.8.1 to 1.9.1 - [Release notes](https://github.com/KyleMayes/clang-sys/releases) - [Changelog](https://github.com/KyleMayes/clang-sys/blob/master/CHANGELOG.md) - [Commits](https://github.com/KyleMayes/clang-sys/compare/v1.8.1...v1.9.1) Updates `clap_builder` from 4.6.2 to 4.6.6 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/v4.6.2...v4.6.6) Updates `find-msvc-tools` from 0.1.9 to 0.1.10 - [Release notes](https://github.com/rust-lang/cc-rs/releases) - [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/cc-rs/compare/find-msvc-tools-v0.1.9...find-msvc-tools-v0.1.10) Updates `getrandom` from 0.4.1 to 0.4.3 - [Changelog](https://github.com/rust-random/getrandom/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/getrandom/compare/v0.4.1...v0.4.3) Updates `glam` from 0.33.2 to 0.33.3 - [Changelog](https://github.com/bitshifter/glam-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/bitshifter/glam-rs/compare/0.33.2...0.33.3) Updates `hashbrown` from 0.15.5 to 0.17.0 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.15.5...v0.17.0) Updates `js-sys` from 0.3.103 to 0.3.104 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) Updates `rand` from 0.10.0 to 0.10.2 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/0.10.0...0.10.2) Updates `rand_core` from 0.10.0 to 0.10.1 - [Release notes](https://github.com/rust-random/rand_core/releases) - [Changelog](https://github.com/rust-random/rand_core/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand_core/compare/v0.10.0...v0.10.1) Updates `regex-automata` from 0.4.16 to 0.4.18 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/regex/compare/regex-automata-0.4.16...regex-automata-0.4.18) Updates `toml` from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/toml-v1.1.3...toml-v1.1.4) Updates `wasm-bindgen` from 0.2.126 to 0.2.127 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/compare/0.2.126...0.2.127) Updates `wasm-bindgen-macro` from 0.2.126 to 0.2.127 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/compare/0.2.126...0.2.127) Updates `wasm-bindgen-macro-support` from 0.2.126 to 0.2.127 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/compare/0.2.126...0.2.127) Updates `wasm-bindgen-shared` from 0.2.126 to 0.2.127 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/compare/0.2.126...0.2.127) Updates `wit-bindgen` from 0.51.0 to 0.57.1 - [Release notes](https://github.com/bytecodealliance/wit-bindgen/releases) - [Commits](https://github.com/bytecodealliance/wit-bindgen/compare/v0.51.0...v0.57.1) Updates `zerocopy-derive` from 0.8.55 to 0.8.56 - [Release notes](https://github.com/google/zerocopy/releases) - [Commits](https://github.com/google/zerocopy/compare/v0.8.55...v0.8.56) --- updated-dependencies: - dependency-name: displaydoc dependency-version: 0.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: thiserror dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: zerocopy dependency-version: 0.8.56 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: clap dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: micro_http dependency-version: 7975fe0e59000e8c41cb1d58fbd39ffa102e5b27 dependency-type: direct:production dependency-group: firecracker - dependency-name: aws-lc-rs dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: firecracker - dependency-name: base64 dependency-version: 0.23.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: aho-corasick dependency-version: 1.1.5 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: aws-lc-sys dependency-version: 0.44.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: firecracker - dependency-name: cc dependency-version: 1.4.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: clang-sys dependency-version: 1.9.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: firecracker - dependency-name: clap_builder dependency-version: 4.6.6 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: find-msvc-tools dependency-version: 0.1.10 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: getrandom dependency-version: 0.4.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: glam dependency-version: 0.33.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: hashbrown dependency-version: 0.17.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: firecracker - dependency-name: js-sys dependency-version: 0.3.104 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: rand dependency-version: 0.10.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: rand_core dependency-version: 0.10.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: regex-automata dependency-version: 0.4.18 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: toml dependency-version: 1.1.4+spec-1.1.0 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: wasm-bindgen dependency-version: 0.2.127 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: wasm-bindgen-macro dependency-version: 0.2.127 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: wasm-bindgen-macro-support dependency-version: 0.2.127 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: wasm-bindgen-shared dependency-version: 0.2.127 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker - dependency-name: wit-bindgen dependency-version: 0.57.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: firecracker - dependency-name: zerocopy-derive dependency-version: 0.8.56 dependency-type: indirect update-type: version-update:semver-patch dependency-group: firecracker ... Signed-off-by: dependabot[bot] <support@github.com>
docs: fix duplicated words in RELEASE_POLICY and net device comment
Drop the repeated "of" in two RELEASE_POLICY.md examples and the repeated "to" in the net device TOCTOU comment. Documentation and comments only, no functional change. [mancio@amazon.com: re-wrap paragraph to 80 columns for mdformat] Signed-off-by: Noa Levi <275430404+lphuc2250gma@users.noreply.github.com> Signed-off-by: Riccardo Mancini <mancio@amazon.com>
Branches
Tree
README.md
<picture>
<source media="(prefers-color-scheme: dark)" srcset="docs/images/fc_logo_full_transparent-bg_white-fg.png">
<source media="(prefers-color-scheme: light)" srcset="docs/images/fc_logo_full_transparent-bg.png">
<img alt="Firecracker Logo Title" width="750" src="docs/images/fc_logo_full_transparent-bg.png">
</picture>
Our mission is to enable secure, multi-tenant, minimal-overhead execution of
container and function workloads.
Read more about the Firecracker Charter [here](CHARTER.md).
## What is Firecracker?
Firecracker is an open source virtualization technology that is purpose-built
for creating and managing secure, multi-tenant container and function-based
services that provide serverless operational models. Firecracker runs workloads
in lightweight virtual machines, called microVMs, which combine the security and
isolation properties provided by hardware virtualization technology with the
speed and flexibility of containers.
## Overview
The main component of Firecracker is a virtual machine monitor (VMM) that uses
the Linux Kernel Virtual Machine (KVM) to create and run microVMs. Firecracker
has a minimalist design. It excludes unnecessary devices and guest-facing
functionality to reduce the memory footprint and attack surface area of each
microVM. This improves security, decreases the startup time, and increases
hardware utilization. Firecracker has also been integrated in container
runtimes, for example
[Kata Containers](https://github.com/kata-containers/kata-containers) and
[Flintlock](https://github.com/liquidmetal-dev/flintlock).
Firecracker was developed at Amazon Web Services to accelerate the speed and
efficiency of services like [AWS Lambda](https://aws.amazon.com/lambda/) and
[AWS Fargate](https://aws.amazon.com/fargate/). Firecracker is open sourced
under [Apache version 2.0](LICENSE).
To read more about Firecracker, check out
[firecracker-microvm.io](https://firecracker-microvm.github.io).
## Getting Started
To get started with Firecracker, download the latest
[release](https://github.com/firecracker-microvm/firecracker/releases) binaries
or build it from source.
You can build Firecracker on any Unix/Linux system that has Docker running (we
use a development container) and `bash` installed, as follows:
```bash
git clone https://github.com/firecracker-microvm/firecracker
cd firecracker
tools/devtool build
toolchain="$(uname -m)-unknown-linux-musl"
```
The Firecracker binary will be placed at
`build/cargo_target/${toolchain}/debug/firecracker`. For more information on
building, testing, and running Firecracker, go to the
[quickstart guide](docs/getting-started.md).
The overall security of Firecracker microVMs, including the ability to meet the
criteria for safe multi-tenant computing, depends on a well configured Linux
host operating system. A configuration that we believe meets this bar is
included in [the production host setup document](docs/prod-host-setup.md).
## Contributing
Firecracker is already running production workloads within AWS, but it's still
Day 1 on the journey guided by our [mission](CHARTER.md). There's a lot more to
build and we welcome all contributions.
To contribute to Firecracker, check out the development setup section in the
[getting started guide](docs/getting-started.md) and then the Firecracker
[contribution guidelines](CONTRIBUTING.md).
## Releases
New Firecracker versions are released via the GitHub repository
[releases](https://github.com/firecracker-microvm/firecracker/releases) page,
typically every two or three months. A history of changes is recorded in our
[changelog](CHANGELOG.md).
The Firecracker release policy is detailed [here](docs/RELEASE_POLICY.md).
## Design
Firecracker's overall architecture is described in
[the design document](docs/design.md).
## Features & Capabilities
Firecracker consists of a single micro Virtual Machine Manager process that
exposes an API endpoint to the host once started. The API is
[specified in OpenAPI format](src/firecracker/swagger/firecracker.yaml). Read
more about it in the [API docs](docs/api_requests).
The **API endpoint** can be used to:
- Configure the microvm by:
- Setting the number of vCPUs (the default is 1).
- Setting the memory size (the default is 128 MiB).
- Configuring a [CPU template](docs/cpu_templates/cpu-templates.md).
- Add one or more network interfaces to the microVM.
- Add one or more read-write or read-only disks to the microVM, each represented
by a file-backed block device.
- Trigger a block device re-scan while the guest is running. This enables the
guest OS to pick up size changes to the block device's backing file.
- Change the backing file for a block device, before or after the guest boots.
- Configure rate limiters for virtio devices which can limit the bandwidth,
operations per second, or both.
- Configure the logging and metric system.
- `[BETA]` Configure the data tree of the guest-facing metadata service. The
service is only available to the guest if this resource is configured.
- Add a [vsock socket](docs/vsock.md) to the microVM.
- Add a [entropy device](docs/entropy.md) to the microVM.
- Add a [pmem device](docs/pmem.md) to the microVM.
- Configure and manage [memory hotplugging](docs/memory-hotplug.md).
- `[Developer Preview]` [Hot-plug and hot-unplug](docs/device-hotplug.md) virtio
PCI devices while the VM is running.
- Start the microVM using a given kernel image, root file system, and boot
arguments.
- [x86_64 only] Stop the microVM.
**Built-in Capabilities**:
- Demand fault paging and CPU oversubscription enabled by default.
- Advanced, thread-specific seccomp filters for enhanced security.
- [Jailer](docs/jailer.md) process for starting Firecracker in production
scenarios; applies a cgroup/namespace isolation barrier and then drops
privileges.
## Tested platforms
We test all combinations of:
| Instance | Host OS & Kernel | Guest Rootfs | Guest Kernel |
| :------------------------------------------ | :---------------- | :----------- | :----------- |
| m5n.metal (Intel Cascade Lake) | al2 linux_5.10 | ubuntu 24.04 | linux_5.10 |
| m6i.metal (Intel Ice Lake) | al2023 linux_6.1 | | linux_6.1 |
| | al2023 linux_6.18 | | |
| m7i.metal-24xl (Intel Sapphire Rapids) | | | |
| m7i.metal-48xl (Intel Sapphire Rapids) | | | |
| **m8i.metal-48xl (Intel Granite Rapids)\*** | | | |
| **m8i.metal-96xl (Intel Granite Rapids)\*** | | | |
| m6a.metal (AMD Milan) | | | |
| m7a.metal-48xl (AMD Genoa) | | | |
| m6g.metal (Graviton 2) | | | |
| m7g.metal (Graviton 3) | | | |
| m8g.metal-24xl (Graviton 4) | | | |
| m8g.metal-48xl (Graviton 4) | | | |
**\***: We **only** support AWS EC2 8th Gen Intel (\*8i) instances using a 6.1
or 6.18 host kernel. This is due to poor kernel support for Granite Rapids CPUs
on 5.10.
## Known issues and Limitations
- The `pl031` RTC device on aarch64 does not support interrupts, so guest
programs which use an RTC alarm (e.g. `hwclock`) will not work.
## Performance
Firecracker's performance characteristics are listed as part of the
[specification documentation](SPECIFICATION.md). All specifications are a part
of our commitment to supporting container and function workloads in serverless
operational models, and are therefore enforced via continuous integration
testing.
## Policy for Security Disclosures
The security of Firecracker is our top priority. If you suspect you have
uncovered a vulnerability, contact us privately, as outlined in our
[security policy document](SECURITY.md); we will immediately prioritize your
disclosure.
## FAQ & Contact
Frequently asked questions are collected in our [FAQ doc](FAQ.md).
You can get in touch with the Firecracker community in the following ways:
- Security-related issues, see our [security policy document](SECURITY.md).
- Chat with us on our
[Slack workspace](https://join.slack.com/t/firecracker-microvm/shared_invite/zt-3v81btcpe-usCf8Qk7k1gUlSAEKKdYMg)
_Note: most of the maintainers are on a European time zone._
- Open a GitHub issue in this repository.
- Email the maintainers at
[firecracker-maintainers@amazon.com](mailto:firecracker-maintainers@amazon.com).
When communicating within the Firecracker community, please mind our
[code of conduct](CODE_OF_CONDUCT.md).