Firecracker

Definition

Firecracker is an open-source virtual machine monitor that creates minimal, lightweight virtual machines called microVMs, purpose-built for running short-lived, multi-tenant workloads such as serverless functions and containers with strong isolation. It uses the Linux KVM subsystem for hardware virtualization while stripping away the device emulation and features unnecessary for these workloads, enabling startup times measured in milliseconds and a memory footprint of only a few megabytes per instance.

Overview

Serverless platforms need to run untrusted code from many different customers on shared hardware, isolating each invocation as strongly as a full virtual machine while starting up fast enough to feel instantaneous. Traditional virtual machines built on a general hypervisor were too slow to boot and too resource-heavy for this pattern, while containers alone shared a kernel and offered weaker isolation between tenants. Firecracker addresses this gap with a minimal virtual machine monitor written for security and speed rather than general compatibility. It implements a tiny device model, exposing only a handful of essential virtual devices such as a block device and a network interface, and delegates actual CPU and memory virtualization to the Linux kernel's KVM subsystem. This minimalism, combined with a memory footprint of only a few megabytes per microVM, lets a single host run thousands of isolated microVMs and boot each one in well under a second. Compared with QEMU, which Firecracker's authors originally used and found too heavy for this use case, Firecracker deliberately omits legacy device emulation, BIOS boot paths, and other general-purpose virtualization features. It also differs from container-only sandboxes like gVisor or Kata Containers by providing true hardware-level virtual machine isolation rather than syscall interception or a lightweight VM wrapped around a full container runtime. Firecracker underlies AWS Lambda and AWS Fargate, where each function invocation or task runs inside its own microVM to isolate it from other customers' workloads on the same physical server. It has also been adopted by other platforms building multi-tenant, function-as-a-service, or container-as-a-service offerings that need VM-grade isolation without VM-grade boot times, and some container runtimes use it as a pluggable backend for running individual containers inside their own microVM for extra isolation. Because Firecracker deliberately supports a minimal set of devices and no graphical console, it is unsuitable for general-purpose virtualization needs such as running arbitrary desktop or legacy operating systems. It also requires KVM and Linux, so it cannot run on non-Linux hosts or without hardware virtualization support, and its narrow feature set means integrators must build orchestration and networking around it rather than relying on built-in tooling. Teams adopting Firecracker directly, rather than through a managed platform like Lambda, take on the work of building scheduling, image distribution, and networking layers themselves, which is a substantial undertaking compared to using a general-purpose hypervisor with existing management tooling, and this is why most organizations encounter Firecracker indirectly through a managed serverless product rather than operating it as infrastructure on their own.

Key Features

• MicroVMs boot in under a second with minimal memory overhead
• Uses Linux KVM for hardware-virtualized CPU and memory isolation
• Implements a minimal virtio-based device model with no legacy hardware emulation
• Runs thousands of isolated microVMs per host with a small per-VM footprint
• Provides a jailer process for additional sandboxing of the VM process
• Powers multi-tenant isolation for AWS Lambda and AWS Fargate
• Exposes a REST-like API for programmatic microVM lifecycle management
• Open source and designed for integration into custom orchestration systems

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps