Show HN: Firecracker Lab – Build a microVM from a container image | Hacker News Reader

Show HN: Firecracker Lab – Build a microVM from a container image

github.com

35 pointsalexellisuk16 comments

Many of the examples you'll find are broken due to changes in Firecracker 1.0 - the official quickstart guide doesn't cover the most interesting thing - working Internet access - or extracting a filesystem from a container.

Edit: I've added a link for a live-stream I'll be doing with Richard Case from Weaveworks on use-cases, differences vs. containers and legacy VMs - and a number of demos.

I think I understand the use case for firecracker if you're a hosting provider like AWS or Fly.io: you don't want one customer's containers messing with those of another container.

If you're only running your own code, is Firecracker better in some way than just using docker?

It offers a greater degree of sandboxing

Right, but if I'm only running my own code, I probably don't care about that, right?

Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way.

There's also ignite which works with firecracker: https://github.com/weaveworks/ignite

Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.

Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box.

If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail.

Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?

If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.

This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...

Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs.

I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?

It depends. In a container, you can't really run docker itself or full K3s for instance.

So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want.

Of course, we are covering all this in the live-stream, see the link at the end of the repo!

Yes. Firecracker makes sense if you are going to run apps supplied by a third-party. It’s all about isolation.

The story with firecracker is that it’s a great tool for rolling out very lightweight vms. It’s for sure production ready. What’s missing is a nicely packaged docker-like set of tools which do not require a bunch of different technologies being glued together. The biggest one being for sure integrated overlay cni…

I’ve written a bit on firecracker before: https://gruchalski.com/tags/firecracker/.

I believe you can suspend a firecracker VM to disk and resume it way faster than starting a container. If I'm not mistaken firecracker powers things like AWS lambda

I find the pre-reqs odd in enumerating bare metal, Digital Ocean, and GCP, while omitting AWS.

Firecracker was developed at Amazon Web Services to accelerate the speed and efficiency of services like AWS Lambda and AWS Fargate. Firecracker is open sourced under Apache version 2.0.

To read more about Firecracker, check out https://firecracker-microvm.io.

AWS would fall under “bare metal”, it’s vms do not support nested virtualization (whereas the other listed providers do).

You can get bare-metal instances on AWS :) I've added a link to another repo I maintain that lists all the places I know of to get bare-metal servers. Hope that helps.

Reply on news.ycombinator.com