|
66 | 66 | <header>Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services.</header> |
67 | 67 | <section> |
68 | 68 | <p>Until now, you needed to choose between containers with fast startup times and high density, or VMs with strong hardware-virtualization-based security and workload isolation. With Firecracker, you no longer have to choose. Firecracker enables you to deploy workloads in lightweight virtual machines, called microVMs, which provide enhanced security and workload isolation over traditional VMs, while enabling the speed and resource efficiency of containers. Firecracker was developed at Amazon Web Services to improve the customer experience of services like <a href="https://aws.amazon.com/lambda/">AWS Lambda</a> and <a href="https://aws.amazon.com/fargate/">AWS Fargate</a>.<p/> |
69 | | - <p>Firecracker implements a virtual machine monitor (VMM) that uses the Linux Kernel-based Virtual Machine (KVM) to create and manage microVMs. Firecracker has a minimalist design. It excludes unnecessary devices and guest functionality to reduce the memory footprint and attack surface area of each microVM. This improves security, decreases the startup time, and increases hardware utilization. Firecracker currently supports Intel CPUs, with planned AMD and Arm support. Firecracker will also be integrated with popular container runtimes such as containerd. Our latest roadmap can be found <a href="https://github.com/firecracker-microvm/firecracker/labels/Roadmap">here</a>.</p> |
| 69 | + <p>Firecracker is a virtual machine monitor (VMM) that uses the Linux Kernel-based Virtual Machine (KVM) to create and manage microVMs. Firecracker has a minimalist design. It excludes unnecessary devices and guest functionality to reduce the memory footprint and attack surface area of each microVM. This improves security, decreases the startup time, and increases hardware utilization. Firecracker currently supports Intel CPUs, with AMD and Arm support in developer preview.</p> |
| 70 | + <p>Firecracker is integrated with <a href="https://github.com/kata-containers/documentation/wiki/Initial-release-of-Kata-Containers-with-Firecracker-support">Kata Containers</a>, <a href="https://www.weave.works/oss/firekube/">Weave FireKube</a> (via <a href="https://github.com/weaveworks/ignite">Weave Ignite</a>), and containerd via <a href="https://github.com/firecracker-microvm/firecracker-containerd">firecracker-containerd</a>. It's also available within the <a href="https://github.com/solo-io/unik">UniK</a> unikernel and microVM platform. Firecracker can run Linux and <a href="http://blog.osv.io/blog/2019/04/19/making-OSv-run-on-firecraker">OSv</a> guests. Our latest roadmap can be found <a href="https://github.com/firecracker-microvm/firecracker/projects/13">here</a>.</p> |
70 | 71 | </section> |
71 | 72 | </article> |
72 | 73 | </section> |
|
91 | 92 | </a> |
92 | 93 | </div> |
93 | 94 | </div> |
94 | | - </section> |
| 95 | + </section> |
95 | 96 | <section class="mdl-benefits"> |
96 | 97 | <div class="m-content"> |
97 | 98 | <div id="benefits" name="benefits" class="m-title">Benefits</div> |
|
108 | 109 | <img src=" img/[email protected]" alt=" Speed icon" > |
109 | 110 | <header>Speed by design</header> |
110 | 111 | </div> |
111 | | - <section>In addition to a minimal device model, Firecracker also accelerates kernel loading and provides a minimal guest kernel configuration. This enables fast startup times. Firecracker initiates user space or application code in less than 125ms and supports microVM creation rates of 150 microVMs per second per host.</section> |
| 112 | + <section>In addition to a minimal device model, Firecracker also accelerates kernel loading and provides a minimal guest kernel configuration. This enables fast startup times. Firecracker initiates user space or application code in as little as 125 ms and supports microVM creation rates of up to 150 microVMs per second per host.</section> |
112 | 113 | </article> |
113 | 114 | <article class="m-item"> |
114 | 115 | <div class="m-header"> |
115 | 116 | <img src=" img/[email protected]" alt=" hardware icon" > |
116 | 117 | <header>Scale and efficiency</header> |
117 | 118 | </div> |
118 | | - <section>Each Firecracker microVM runs with a reduced memory overhead of less than 5MiB, enabling a high density of microVMs to be packed on each server. Firecracker provides a rate limiter built into every microVM. This enables optimized sharing of network and storage resources, even across thousands of microVMs. </section> |
| 119 | + <section>Each Firecracker microVM runs with a reduced memory overhead of less than 5 MiB, enabling a high density of microVMs to be packed on each server. Firecracker provides a rate limiter built into every microVM. This enables optimized sharing of network and storage resources, even across thousands of microVMs. </section> |
119 | 120 | </article> |
120 | 121 | </div> |
121 | 122 | </div> |
|
129 | 130 | <img src=" img/[email protected]" class=" m-device" alt=" Firecracker diagram" > |
130 | 131 | </div> |
131 | 132 | <section> |
132 | | - <p>Firecracker runs in user space and uses the Linux Kernel-based Virtual Machine (KVM) to create microVMs. The fast startup time and low memory overhead of each microVM enables you to pack thousands of microVMs onto the same machine. This means that every function or container group can be encapsulated with a virtual machine barrier, enabling workloads from different customers to run on the same machine, without any tradeoffs to security or efficiency. Firecracker is an alternative to QEMU, an established VMM with a general purpose and broad feature set that allows it to host a variety of guest operating systems.</p> |
133 | | - <p>You can control the Firecracker process via a RESTful API that enables common actions such as configuring the number of vCPUs or starting the machine. It provides built-in rate limiters, which allows you to granularly control network and storage resources used by thousands of microVMs on the same machine. You can create and configure rate limiters via the Firecracker API and define flexible rate limiters that support bursts or specific bandwidth/operations limitations. Firecracker also provides a metadata service that securely shares configuration information between the host and guest operating system. You can set up and configure the metadata service using the Firecracker API.</p> |
| 133 | + <p>Firecracker runs in user space and uses the Linux Kernel-based Virtual Machine (KVM) to create microVMs. The fast startup time and low memory overhead of each microVM enables you to pack thousands of microVMs onto the same machine. This means that every function, container, or container group can be encapsulated with a virtual machine barrier, enabling workloads from different customers to run on the same machine, without any tradeoffs to security or efficiency. Firecracker is an <a href="https://www.redhat.com/en/blog/all-you-need-know-about-kvm-userspace">alternative to QEMU</a>, an established VMM with a general purpose and broad feature set that allows it to host a variety of guest operating systems.</p> |
| 134 | + <p>You can control the Firecracker process via a RESTful API that enables common actions such as configuring the number of vCPUs or starting the machine. It provides built-in rate limiters, which allows you to granularly control network and storage resources used by thousands of microVMs on the same machine. You can create and configure rate limiters via the Firecracker API and define flexible rate limiters that support bursts or specific bandwidth/operations limitations. Firecracker also provides a metadata service that securely shares configuration information between the host and guest operating system. You can set up and configure the metadata service using the Firecracker API. Each Firecracker microVM is further isolated with common Linux user-space security barriers by a companion program called "jailer". The jailer provides a second line of defense in case the virtualization barrier is ever compromised.</p> |
134 | 135 | </section> |
135 | 136 | </article> |
136 | 137 | </section> |
|
140 | 141 | <div class="m-grid sta-masonry"> |
141 | 142 | <article class="m-item"> |
142 | 143 | <header>Who developed Firecracker?</header> |
143 | | - <section>Firecracker was built by developers at Amazon Web Services to enable services such as <a href="https://aws.amazon.com/lambda/">AWS Lambda</a> and <a href="https://aws.amazon.com/fargate/">AWS Fargate</a> to improve resource utilization and customer experience, while providing the security and isolation required of public cloud infrastructure. Firecracker started from Chromium OS's Virtual Machine Monitor (crosvm), an open source VMM written in Rust. Today, crosvm and Firecracker have diverged to serve very different customer needs. We plan to contribute bug fixes and tests for Rust crates that originated from crosvm, and any Firecracker functionality that's appealing for crosvm.</section> |
| 144 | + <section>Firecracker was built by developers at Amazon Web Services to enable services such as <a href="https://aws.amazon.com/lambda/">AWS Lambda</a> and <a href="https://aws.amazon.com/fargate/">AWS Fargate</a> to improve resource utilization and customer experience, while providing the security and isolation required of public cloud infrastructure. Firecracker started from Chromium OS's Virtual Machine Monitor, <a href="https://chromium.googlesource.com/chromiumos/platform/crosvm/">crosvm</a>, an open source VMM written in Rust. Today, crosvm and Firecracker have diverged to serve very different customer needs. <a href="https://github.com/rust-vmm">Rust-vmm</a> is an open source community where we collaborate with crosvm and other groups and individuals to build and share quality Rust virtualization components.</section> |
144 | 145 | </article> |
145 | 146 | <article class="m-item"> |
146 | 147 | <header>Why did you develop Firecracker?</header> |
147 | | - <section>When we launched Lambda in November of 2014, we were focused on providing a secure <a href="https://aws.amazon.com/serverless/">serverless</a> experience. At launch we used per-customer EC2 instances to provide strong security and isolation between customers. As Lambda grew, we saw the need for technology to provide a highly secure, flexible, and efficient runtime environment for services like Lambda and Fargate. Using our experience building isolated EC2 instances with hardware virtualization technology, we started an effort to build a VMM that was tailored to integrate with container ecosystems.</section> |
| 148 | + <section>When we launched Lambda in November of 2014, we were focused on providing a secure <a href="https://aws.amazon.com/serverless/">serverless</a> experience. At launch we used per-customer EC2 instances to provide strong security and isolation between customers. As Lambda grew, we saw the need for technology to provide a highly secure, flexible, and efficient runtime environment for services like Lambda and Fargate. Using our experience building isolated EC2 instances with hardware virtualization technology, we started an effort to build a VMM that was tailored to run serverless functions and integrate with container ecosystems.</section> |
148 | 149 | </article> |
149 | 150 | <article class="m-item"> |
150 | 151 | <header>What processors does Firecracker support?</header> |
151 | | - <section>The Firecracker VMM is built to be processor agnostic. Today, it can run on Intel processors. AMD and Arm processors will be supported in the near future.</section> |
| 152 | + <section>The Firecracker VMM is built to be processor agnostic. Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview.</section> |
152 | 153 | </article> |
153 | 154 | <article class="m-item"> |
154 | 155 | <header>What language is Firecracker written in?</header> |
155 | 156 | <section>Firecracker is written in Rust.</section> |
156 | 157 | </article> |
157 | 158 | <article class="m-item"> |
158 | | - <header>Can Firecracker be used with Kubernetes, Docker, or Kata containers today?</header> |
159 | | - <section>Not yet. We are making Firecracker open source because it provides a meaningfully different approach to security for running containers. We hope that others in the communities that build open source container technology find it useful. We are working to make Firecracker integrate naturally with the container ecosystem, with the goal to provide seamless integration in the future to provide more choices in how container workloads are isolated.</section> |
| 159 | + <header>Can Firecracker be used within the container ecosystem?</header> |
| 160 | + <section>Yes. Firecracker is integrated with <a href="https://github.com/kata-containers/documentation/wiki/Initial-release-of-Kata-Containers-with-Firecracker-support">Kata Containers</a>, <a href="https://www.weave.works/oss/firekube/">Weave FireKube</a> (via <a href="https://github.com/weaveworks/ignite">Weave Ignite</a>), and containerd via <a href="https://github.com/firecracker-microvm/firecracker-containerd">firecracker-containerd</a>.</section> |
160 | 161 | </article> |
161 | 162 | <article class="m-item"> |
162 | | - <header>What is the difference between Firecracker and Kata Containers and QEMU?</header> |
163 | | - <section>Kata Containers is an OCI-compliant container runtime that executes containers within QEMU based virtual machines. Firecracker is a cloud-native alternative to QEMU that is purpose-built for running containers safely and efficiently, and nothing more. Firecracker provides a minimal required device model to the guest operating system while excluding non-essential functionality (there are only 4 emulated devices: virtio-net, virtio-block, serial console, and a 1-button keyboard controller used only to stop the microVM). This, along with a streamlined kernel loading process enables a < 125 ms startup time and a reduced memory footprint. The Firecracker process also provides a RESTful control API, handles resource rate limiting for microVMs, and provides a microVM metadata service to enable the sharing of configuration data between the host and guest.</section> |
| 163 | + <header>What is the difference between Firecracker and QEMU?</header> |
| 164 | + <section>Firecracker is an <a href="https://www.redhat.com/en/blog/all-you-need-know-about-kvm-userspace">alternative to QEMU</a> that is purpose-built for running serverless functions and containers safely and efficiently, and nothing more. Firecracker is written in Rust, provides a minimal required device model to the guest operating system while excluding non-essential functionality (only 5 emulated devices are available: virtio-net, virtio-block, virtio-vsock, serial console, and a minimal keyboard controller used only to stop the microVM). This, along with a streamlined kernel loading process enables a < 125 ms startup time and a < 5 MiB memory footprint. The Firecracker process also provides a RESTful control API, handles resource rate limiting for microVMs, and provides a microVM metadata service to enable the sharing of configuration data between the host and guest.</section> |
164 | 165 | </article> |
165 | 166 | <article class="m-item"> |
166 | 167 | <header>What operating systems are supported by Firecracker?</header> |
167 | | - <section>Firecracker supports Linux host and guest operating systems with kernel versions 4.14 and above. The long-term support plan is still under discussion. A leading option is to support Firecracker for the last two Linux stable branch releases.</section> |
| 168 | + <section>Firecracker supports Linux host and guest operating systems with kernel versions 4.14 and above, as well as <a href="http://blog.osv.io/blog/2019/04/19/making-OSv-run-on-firecraker/">OSv</a> guests. The long-term support plan is still under discussion.</section> |
168 | 169 | </article> |
169 | 170 | <article class="m-item"> |
170 | 171 | <header>What is the open source license for Firecracker?</header> |
|
229 | 230 | <a href="#home"> |
230 | 231 | <img src=" img/[email protected]" alt=" Firecracker logo" > |
231 | 232 | </a> |
232 | | - <div>©2018, Amazon Web Services, Inc or its affiliates. All rights reserved.</div> |
| 233 | + <div>©2018 - 2019, Amazon Web Services, Inc or its affiliates. All rights reserved.</div> |
233 | 234 | </div> |
234 | 235 | </footer> |
235 | 236 | </section> |
|
0 commit comments