11 ms·
Firecracker: Secure and fast microVMs for serverless computing
- pimlottc 7y ago> Firecracker: OSS virtualization techno, creating and managing secure, multi-tena This title is a bit awkwardly worded; in particular, "techno" in American English is a genre of music, not an abbreviation for "technology".
- dang 7y agoWe've reverted it now. Submitted title was "Firecracker: OSS virtualization techno, creating and managing secure, multi-tena". Submitters: please don't do that—this is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. If a title is misleading or baity, please rewrite it, but please also make it good English.
- rvz 7y ago> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by security researchers which have cataclysmic implications for users and server providers these days. This is demonstrated by a ridiculous Intel vulnerability which rendered Apple's FileVault encryption facilities completely useless which is absolutely unacceptable to Apple. There are many other CPU vulnerabilities waiting to be found and it could be the next Meltdown-like candidate. The sooner the move to AMD or RISC-V open technologies, the better for developers and users.
- deleted 7y ago[deleted]
- dualboot 7y agoIntel has been an absolute security shit-show for over 3 years now. The shift is underway but it takes time.
- vorticalbox 7y agoMeltdown effects all the way back to 2nd gen(2010), it's been bad for a decade we just didn't know.
- blasdel 7y agoMeltdown goes much further back than that, potentially all the way to the Pentium Pro (1995) It was also independently implemented in POWER and ARM A75
- karambahh 7y agoI am actually surprised by the absence of AMD support for a project born at AWS. AWS has been offering AMD Epyc ec2 instances for quite awhile[0]. Missing arm support is also suprising but less so, as arm market penetration is obviously lower than x64 [0]https://aws.amazon.com/fr/ec2/amd/ https://aws.amazon.com/fr/ec2/amd/
- bluk 7y agoRegarding the Apple's FileVault bit, are you referring to the recently disclosed Intel vulnerability ( https://www.theregister.co.uk/2020/03/05/unfixable_intel_csme_flaw/ https://www.theregister.co.uk/2020/03/05/unfixable_intel_csm... ). Did FileVault ever use this Intel feature (even on non-T2 Macs)? It seems that there is some contention on Twitter whether FileVault is affected.
- infotogivenm 7y agoBesides that... “completely useless?” Is that right? The only way you make disk encryption totally useless is by breaking the crypto. This allows an evil maid attack at best... a very different vector for most people than “completely useless”.
- otterley 7y ago(I work for AWS, but not on the Firecracker team. Opinions are my own and not of the company.) Firecracker is open source. We welcome community contributions to bring the technology to additional CPU architectures. Also, as other commenters have noted, AMD support is already in-tree. It's just in Developer Preview, which indicates the relative level of maturity. AWS does not have any RISC-V processors in its EC2 offering portfolio, but if customers are demanding them, we'd love to hear from you - please reach out to your account team.
- mrkurt 7y agoFirecracker is great We use it to run fleets of fast booting vms at https://fly.io https://fly.io. It’s really the best OSS to come out of Amazon.
- carapace 7y agoWhat's OSS in this context?
- mrkurt 7y agoOpen source software.
- carapace 7y agoOh FOSS. Got it.
- CameronNemo 7y agoDo people still try to claim that source available is open source? I go by the OSI definition.
- carapace 7y agoThat was weird, I'm not sure why that comment got flagged. I'm not sure what you're asking. I really was confused about what "OSS" meant w/o the "F" in front.
- michael_j_ward 7y agoWhat do you use for orchestration?
- mrkurt 7y agoNomad + our own firecracker task driver. There's a promising open source task driver for Firecracker as well (ours does a ton that's specific to our networking setup): https://nomadproject.io/docs/drivers/external/firecracker-task-driver/ https://nomadproject.io/docs/drivers/external/firecracker-ta...
- ausjke 7y agodocker is used for microservices, is firecraker designed for serverless applications? what's the key difference between firecracker and docker? are these two overlapped?
- bennyz 7y agoAmazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.
- solarkraft 7y agoWhy does FaaS (that's what Lambda is, right?) need more full blown virtualization? I thought you could maybe get away with even lighter separation than Docker?
- bronxbomber92 7y agoI know very little about the actual technology, but I feel like the blurb on their front page explains this succinctly: “ Firecracker enables you to deploy workloads in lightweight virtual machines, called microVMs, which provide enhanced security and workload isolation over traditional VMs, while enabling the speed and resource efficiency of containers” Security of a VM + efficiency of a container.
- fiddlerwoaroof 7y agoDocker isn’t really designed to be a security boundary, so if you’re colocating containers from different customers (e.g. in Fargate), you need to separate them with a real security boundary like a VM. The same thing is true for lambdas: a lambda is just an archive and the code in the archive needs to run somewhere where one customer cannot intercept another customer’s data.
- scarface74 7y agoTo add on, AWS has never run Lambdas for different accounts on the same VM. Before Firecracker, they would run multiple Lambdas for the same account on the same VM. Now with Firecracker, they can run each lambda in its own VM.
- tofflos 7y agoI played with Weave Ignite the other day which is a Docker-like CLI for Firecracker. Sure there were some rough edges but the overall experience was pretty good. If you are familiar with the Docker CLI you will be able to get some virtual machines up and running very quickly. Two questions in case someone from Weave tunes into the discussion: I got the impression that VMs needed an SSH server to be accessible. Is this correct and if so will it be possible to implement something similar to docker exec so that I won't need an SSH server on every VM? > At the moment ignite and ignited need root privileges on the host to operate due to certain operations (e.g. mount). This will change in the future. Is there a timetable and could you perhaps elaborate a bit as to why it currently requires root? (I don't know anything about virtual machine internals so this isn't a passive-aggressive question from my side. It's genuine curiosity.)
- legulere 7y agoAt least crosvm which this is based on offers serial device emulation.
- bennyz 7y ago>Is there a timetable and could you perhaps elaborate a bit as to why it currently requires root? (I don't know anything about virtual machine internals so this isn't a passive-aggressive question from my side. It's genuine curiosity.) Not from Weave, but I might have an idea as I've played with Firecracker a bit. When you start up a Firecracker VM, you need to provide it with a rootfs drive, which is a file containing the root file system to be used for the VM. Ignite uses OCI images, so I guess they are doing something similar to [1] in code, the `mount` part requires sudo, so that would be my guess to why you need root. [1] https://github.com/firecracker-microvm/firecracker/blob/master/docs/rootfs-and-kernel-setup.md#creating-a-rootfs-image https://github.com/firecracker-microvm/firecracker/blob/mast...
- imhoguy 7y agoContainers are provided by host kernel cgroups and namespaces, therefore the kernel implements attach (exec) operation which is practically running a new proces (e.g. bash) in a cgroup (container). Virtual Machines are provided by software or hardware emulation which run separate guest OS with own kernel. There is no standard way for a host to let you run any process and interact with its stdio inside guest OS because the host simply is not aware what you exactly run inside. The solution is to have an agreed connectivity standard both on the guest and the host. The guest can provide SSH server, telnet server serial terminal, irc bot or some other kind of control capability. Then of course host needs a tooling too, e.g. SSH client.
- m00dy 7y agoI believe it is still using virtio. Therefore, disk read/writes are not good enough compared to other virtualization tech such as qemu
- ctz 7y ago> disk read/writes are not good enough This is an odd thing to say; surely that depends on the application? I doubt most FaaS users are disk IO-bound?
- yjftsjthsd-h 7y agoI thought virtio was higher performance; why would that make it "not good enough"?
- JoshTriplett 7y agoWhich of qemu's many disk technologies are you proposing as an alternative?
- detaro 7y agoqemu setups often use virtio, afaik virtio was defined by qemu devs, so your statement doesn't really make sense without more details. Also, "not good enough" kind of needs a definition of a workload and what's "good enough" for it.
- bonzini 7y agoIt's using virtio-mmio which is less efficient than virtio-pci. But I/O was not a focus of Firecracker, for example it doesn't scale very well because it doesn't do concurrent I/O operations.
- StreamBright 7y agoI am not sure if this is true. Well, you are not really making a statement that could be easily interpreted. Virtio is specifically created to address performance issues with virtualization. Are you unhappy about the implementation quality or you generally believe that para-virtualization is not the way to go about improving virtualization overhead? One prime example when with virtio it was possible to get native performance _after_ minimum configuration tuning: https://serverfault.com/questions/407842/incredibly-low-kvm-disk-performance-qcow2-disk-files-virtio https://serverfault.com/questions/407842/incredibly-low-kvm-... More details on virtio: https://vmsplice.net/~stefan/virtio-devconf-2014.pdf https://vmsplice.net/~stefan/virtio-devconf-2014.pdf
- asymptotically2 7y agoCan I run a single process in a Firecracker microVM, or do I need to bring a full distro?
- asymptotically2 7y agoSeems like you can, but probably shouldn't since you'd want to run services like chrony to keep time inside the VM.
- darren0 7y ago"Firecracker provides a rate limiter built into every microVM. This enables optimized sharing of network and storage resources, even across thousands of microVMs." Probably the most interesting feature.
- hinkley 7y agoOne of the things you learn about multitasking is that in theory cooperative multitasking is the most efficient, but the least reliable. It’s cheaper (for the human) to use hard and fast rules that trade nasty surprises for vague disappointment. This sounds like a hybrid system. The intermediary is cooperative, the client code is oblivious. I’m curioue to see how this plays out over the long haul.
- ffk 7y agoThis runs Amazon lambda, so presumably well enough?
- hinkley 7y agoYou don’t think 12 years from now we’ll be laughing about how lame Lambda is? Coding practices change like the seasons. Every year is a little different, maybe a little better than the last, some things feel brand new, but the general patterns hold.
- ffk 7y agoI'm sure we'll laugh about most things we are currently using and gasp when we need to revisit them in legacy systems. :)
- ffk 7y agoThis is enabled by disabling anything that depends on pinned kernel memory. You get a VM with user space networking and a one button keyboard. This allows the kernel too aggressively swap out unused resources and ultimately increase the total concurrency supported.
- pbreit 7y agoWhat are some use cases?
- christian7007 7y agoWill microVMs replace containers in short time?
- swyx 7y agoi'd also like to know this..
- detaro 7y agoI'm curious about restarts and snapshotting: would it be feasible to reset a microVM for each incoming request?
- mrkurt 7y agoSnapshot / suspend isn't doable yet, but it sure would be nice. We've booted some apps in Firecracker in <20ms, so if you build the app properly you can absolutely do a new VM per request or TCP connection even.
- scarface74 7y agoYeah, this is what AWS does....
- ec109685 7y agoNo it doesn't. It pre-inits the Firecracker VM's before the first request: https://www.usenix.org/system/files/nsdi20-paper-agache.pdf https://www.usenix.org/system/files/nsdi20-paper-agache.pdf
- scarface74 7y agoI meant the part about one request per VM.
- whalesalad 7y agoMight consider a pre-emptive approach that always keeps a few warmed up and ready to receive a request. The determination on how many to keep warm could be a function of traffic over the last X period of time.
- hinkley 7y agoWasn't fastcgi essentially about starting new processes ahead of time and then doling them out as new requests came in? Worked quite well for bursty traffic, and for sustained traffic was about the same. Feels like a similar strategy could be apropos here. And if I'd read farther down the chain, someone said that Amazon already does this.
- based2 7y agohttps://blog.acolyer.org/2020/03/02/firecracker/ https://blog.acolyer.org/2020/03/02/firecracker/
- williesleg 7y agoWhat a fun experiment! Docker still sucks.
- nicklarsennz 7y agoDoes anyone know if any integration with Kubernetes is on the cards? Something like an operator with CRDs? Or is this intended to be separate, a competitor?
- mrkurt 7y agoThere are a few ways to use k8s + firecracker, weave has one: https://www.weave.works/oss/firekube/ https://www.weave.works/oss/firekube/
- ffk 7y agoThis is more comparable to runc. Firecracker can be used in kubernetes through containerd+kata containers integration. (Containerd from docker is a key tech behind both docker and K8s, kata containers from Intel enables containerd to run vms) I don't think the experience is great yet, but it's on the way.
- eatmyshorts 7y agohttps://www.weave.works/blog/firekube-fast-and-secure-kubernetes-clusters-using-weave-ignite https://www.weave.works/blog/firekube-fast-and-secure-kubern...
- shubidubi 7y agoI'm happy to see AWS is giving back to the open source community.
- swyx 7y agoif you had to guess.. what are your thoughts on why this was open sourced? everybody i listen to seems a little confused by the "why" of this specific action
- hestefisk 7y ago... and all the koolaid drinking Kubernetes fans are now going to refer to Kubernetes as legacy and start creating a new cottage industry of Firecracker migrations. Slightly cynical yes. But also a bit true.
- andrewstuart 7y agoNote Firecracker does not work on AWS cloud instances, apart from bare metal instances.
- tfwnonested 7y ago>2020 >Still no nested virtualization on aws ;( It should work on some azure instances and gce instances when you enable nested virtualization.
- airocker 7y agoWould it not be better to make docker vm aware? The tooling would not have to radically change.
- xrd 7y agoMy skills are more on the developer side, this seems more like a devops tool, right? As such, I'm never really sure if this is something worth playing with. I've played with docker and k8s, and generally understand how those tools help me, but I'm unsure about how firecracker would help unless I'm building a PaaS like fly.io. It would be really cool if someone wrote a blog post which compared running a service on the different comparable options. Developers have the Todo apps written in dozens of frameworks to compare against. Is a similar type of exploration not feasible here?