Getting Started with Firecracker

Published: at 12:00 AM

Articles in this Series

Firecracker is a Virtual Machine Monitor (VMM), a software layer that allows running lightweight VMs on a single physical machine. It is optimized for running microVMs, which provide a secure execution environment & have a small memory and CPU footprint which allows fast startup times and efficient resource utilization.

This is mostly a rehash of the getting-started on the firecracker wiki, we’ll get into more interesting things once we have the base understanding down.

Table of contents

Open Table of contents

Why should I use firecracker?

Firecracker is light weight compared to the alternatives (i.e. QEMU). It has a boot time that’s measured in milliseconds (or faster, with some tuning) and has isolation between microVMs for a strong security posture

There are some reasons not to use firecracker

  1. Limited feature set: Firecracker was designed for serverless computing, so some workloads (i.e. GPU driven) won’t work well.
  2. The performance overhead of not running on bare metal

In general, it’s a pretty good fit for something that’s multitenant & running untrusted workloads.

Setting up the environment

The first step in working with firecracker is getting a host setup with access to the linux Kernel Virtualization Machine (KVM). Both GCP and AWS support nested virtualization, which is the hard requirement for getting access to KVM. Pick whichever cloud you’re more comfortable with.

Option 1: GCP

I went with a GCP compute instance since they’re pretty cheap and I have free credits.

PROJECT=firecracker-project
REGION=us-west1
ZONE=us-west1-a

# Create the GCP project (this takes a few minutes)
gcloud projects create $PROJECT --enable-cloud-apis --set-as-default

# Set some defaults
gcloud config set project $PROJECT
gcloud config set compute/region $REGION
gcloud config set compute/zone $ZONE

INSTANCE_NAME=fc-vm

# Nested virtualization is the hard requirement here
# for allowing access to KVM
gcloud compute instances create $INSTANCE_NAME \
--enable-nested-virtualization \
--min-cpu-platform="Intel Haswell" \
--machine-type=n1-standard-2 \
--boot-disk-size=100GB

Option 2: AWS

As of February 2026, AWS also supports nested virtualization on virtual EC2 instances, so you no longer need a bare metal instance to get access to KVM. It’s currently supported on the C7i, C8i, M8i, and R8i families (among others).

REGION=us-west-2

# Grab the latest Ubuntu 22.04 AMI for the region
AMI=$(aws ssm get-parameters \
--region $REGION \
--names /aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id \
--query 'Parameters[0].Value' --output text)

# Nested virtualization is enabled via --cpu-options.
# KVM is a supported L1 hypervisor, which is what firecracker needs.
aws ec2 run-instances \
--region $REGION \
--image-id $AMI \
--instance-type c8i.large \
--cpu-options "NestedVirtualization=enabled" \
--key-name my-key-pair \
--block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":100}}]'

Verifying KVM access

You can tell if your host is allowed to use KVM by checking the following commands

# is the KVM module installed
lsmod | grep kvm
# Output from when it's installed
kvm_intel             327680  0
kvm                   942080  1 kvm_intel
irqbypass              16384  1 kvm


# Some linux distributions rely on an Access Control List (ACL)
# to manage access to /dev/kvm.
# In order to give permission to yourself, run the following
sudo setfacl -m u:$(whoami):rw /dev/kvm

# Other distributions use the `kvm` group.
# You can check if your linux distribution does
# that by running the following command
bash -c '[ $(stat -c "%G" /dev/kvm) = kvm ] \
&& echo "The /dev/kvm device is managed by the kvm group"'

# To add yourself to that group run the following
sudo usermod -aG kvm $(whoami)

# Then refresh the settings for that group
# for the current terminal session
newgrp kvm

Downloading the required files

To run a guest image, we need a few things:

  1. The firecracker binary
  2. A kernel image
  3. A rootfs image

Let’s download those from the firecracker CI pipeline so that we can get a simple VM up and running. We’ll pull the values from the latest firecracker release.

ARCH="$(uname -m)"

# Discover the latest firecracker release from GitHub
FC_VERSION=$(curl -sI https://github.com/firecracker-microvm/firecracker/releases/latest \
  | grep -i ^location | grep -oP "v[\d.]+")
echo "Firecracker version: $FC_VERSION"

# Kernel + rootfs, mirrored to S3 (firecracker-ci v1.10 ext4 images)
BASE=https://hans-pistor-tech-firecracker-artifacts.s3.us-west-2.amazonaws.com/$ARCH

# Download firecracker binary
curl -L "https://github.com/firecracker-microvm/firecracker/releases/download/${FC_VERSION}/firecracker-${FC_VERSION}-${ARCH}.tgz" | tar -xz
mv release-${FC_VERSION}-${ARCH}/firecracker-${FC_VERSION}-${ARCH} /tmp/firecracker

# Download kernel + rootfs
curl -o /tmp/kernel.bin "$BASE/vmlinux-5.10.223"
curl -o /tmp/rootfs.ext4 "$BASE/ubuntu-22.04.ext4"

Writing a configuration file

The simplest microVM you can create is one with only the boot source (the kernel binary) and a root filesystem (the ubuntu ext4 file). The microVM will have no network connectivity, but that’s an issue to solve later. Write the following into a file (I’m going to use ./vmconfig.json)

{
  "boot-source": {
    "kernel_image_path": "/tmp/kernel.bin",
    "boot_args": "console=ttyS0 reboot=k panic=1 pci=off"
  },
  "drives": [
    {
      "drive_id": "rootfs",
      "is_root_device": true,
      "is_read_only": false,
      "path_on_host": "/tmp/rootfs.ext4"
    }
  ]
}

Launching a uVM

Finally all the files are downloaded, the configuration set, we can spawn a microVM through firecracker!

# Firecracker won't start if the socket file has already been
# created so attempt to delete it first
rm -f /tmp/firecracker.socket \
&& /tmp/firecracker \
--api-sock /tmp/firecracker.socket \
--config-file ./vmconfig.json

You can view code samples for this article on my github .

Articles in this Series