firecracker-containerd

What firecracker-containerd is

firecracker-containerd enables containerd to manage containers as Firecracker microVMs. Running containers inside microVMs can add an isolation layer through the KVM hypervisor. The project describes sandboxing untrusted third-party containers and placing different workloads on multi-tenant hosts as potential uses. It uses container standards such as the OCI image format where possible. Its components include a control plugin and API, an out-of-process shim runtime, an agent running inside the microVM, and a root filesystem image builder. The in-VM agent invokes runC through containerd-shim-runc-v1 to create Linux containers. Networking can use tap devices that were created in advance or devices created automatically by CNI plugins; the getting-started guide names bridge, ptp, host-local, firewall, and tc-redirect-tap. The project is free and licensed under Apache 2.0. It requires a Linux 4.14 or later host, an Intel x86_64 processor, and KVM. The project says AMD and Arm are not supported. Building also requires git, gcc, Docker CE, and Go 1.23 or later. The getting-started guide describes the project as being in a very early state and says it is not yet as plug-and-play as desired. The repository also cautions that multi-tenant use is at the user's own risk, and advises production deployments to select networking suited to their environment and workloads, including attention to isolation between tasks.

Who it suits

This project suits developers and operators who use containerd on Linux and want to run Linux containers inside Firecracker microVMs. Its described use cases include sandboxing untrusted third-party containers and running varied workloads on multi-tenant hosts, subject to the project's stated risk caveat.

Limits

The project requires Linux 4.14 or later, Intel x86_64, and KVM; AMD and Arm are not supported. The getting-started guide describes it as very early-stage, and multi-tenant use is at the user's own risk.

Getting started

1. Open the project repository on GitHub.
2. Use a Linux 4.14 or later host with an Intel x86_64 processor and KVM.
3. Install the listed build prerequisites: git, gcc, Docker CE, and Go 1.23 or later.
4. Review the getting-started guide and choose a networking setup, such as pre-created tap devices or supported CNI plugins.
5. Configure production networking for the environment and workloads, with attention to isolation between tasks.

Verdict

Consider firecracker-containerd if you need containerd to manage Linux containers inside Firecracker microVMs and your host meets its Linux, Intel, and KVM requirements. Look elsewhere if you need support for AMD or Arm, or need a project the guide describes as plug-and-play.