5 ms·

Show HN: Firecracker Lab – Build a microVM from a container image

35 points by alexellisuk 5y ago

rahimnathwani 5y ago
I think I understand the use case for firecracker if you're a hosting provider like AWS or Fly.io: you don't want one customer's containers messing with those of another container. If you're only running your own code, is Firecracker better in some way than just using docker?
- alan-hn 5y ago
  It offers a greater degree of sandboxing
  - rahimnathwani 5y ago
    Right, but if I'm only running my own code, I probably don't care about that, right?
    - alan-hn 5y ago
      Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way. There's also ignite which works with firecracker: https://github.com/weaveworks/ignite https://github.com/weaveworks/ignite
      - kennethh 5y ago
        Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.
        alexellisuk 5y ago
        Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box. If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail. Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?
    - __turbobrew__ 5y ago
      If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.
      - rahimnathwani 5y ago
        This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...
        __turbobrew__ 5y ago
        Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs. I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?
    - alexellisuk 5y ago
      It depends. In a container, you can't really run docker itself or full K3s for instance. So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want. Of course, we are covering all this in the live-stream, see the link at the end of the repo!
    - deleted 5y ago
      [deleted]
- rad_gruchalski 5y ago
  Yes. Firecracker makes sense if you are going to run apps supplied by a third-party. It’s all about isolation. The story with firecracker is that it’s a great tool for rolling out very lightweight vms. It’s for sure production ready. What’s missing is a nicely packaged docker-like set of tools which do not require a bunch of different technologies being glued together. The biggest one being for sure integrated overlay cni… I’ve written a bit on firecracker before: https://gruchalski.com/tags/firecracker/ https://gruchalski.com/tags/firecracker/.
- tylergetsay 5y ago
  I believe you can suspend a firecracker VM to disk and resume it way faster than starting a container. If I'm not mistaken firecracker powers things like AWS lambda
alexellisuk 5y ago
Many of the examples you'll find are broken due to changes in Firecracker 1.0 - the official quickstart guide doesn't cover the most interesting thing - working Internet access - or extracting a filesystem from a container. Edit: I've added a link for a live-stream I'll be doing with Richard Case from Weaveworks on use-cases, differences vs. containers and legacy VMs - and a number of demos.
Terretta 5y ago
I find the pre-reqs odd in enumerating bare metal, Digital Ocean, and GCP, while omitting AWS. Firecracker was developed at Amazon Web Services to accelerate the speed and efficiency of services like AWS Lambda and AWS Fargate. Firecracker is open sourced under Apache version 2.0. To read more about Firecracker, check out https://firecracker-microvm.io https://firecracker-microvm.io.
- alexellisuk 5y ago
  You can get bare-metal instances on AWS :) I've added a link to another repo I maintain that lists all the places I know of to get bare-metal servers. Hope that helps.
- rileymichael 5y ago
  AWS would fall under “bare metal”, it’s vms do not support nested virtualization (whereas the other listed providers do).

35 points by alexellisuk 5y ago

I think I understand the use case for firecracker if you're a hosting provider like AWS or Fly.io: you don't want one customer's containers messing with those of another container. If you're only running your own code, is Firecracker better in some way than just using docker?

alan-hn 5y ago
It offers a greater degree of sandboxing
- rahimnathwani 5y ago
  Right, but if I'm only running my own code, I probably don't care about that, right?
  - alan-hn 5y ago
    Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way. There's also ignite which works with firecracker: https://github.com/weaveworks/ignite https://github.com/weaveworks/ignite
    - kennethh 5y ago
      Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.
      - alexellisuk 5y ago
        Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box. If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail. Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?
  - __turbobrew__ 5y ago
    If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.
    - rahimnathwani 5y ago
      This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...
      - __turbobrew__ 5y ago
        Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs. I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?
  - alexellisuk 5y ago
    It depends. In a container, you can't really run docker itself or full K3s for instance. So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want. Of course, we are covering all this in the live-stream, see the link at the end of the repo!
  - deleted 5y ago
    [deleted]
rad_gruchalski 5y ago
Yes. Firecracker makes sense if you are going to run apps supplied by a third-party. It’s all about isolation. The story with firecracker is that it’s a great tool for rolling out very lightweight vms. It’s for sure production ready. What’s missing is a nicely packaged docker-like set of tools which do not require a bunch of different technologies being glued together. The biggest one being for sure integrated overlay cni… I’ve written a bit on firecracker before: https://gruchalski.com/tags/firecracker/ https://gruchalski.com/tags/firecracker/.
tylergetsay 5y ago
I believe you can suspend a firecracker VM to disk and resume it way faster than starting a container. If I'm not mistaken firecracker powers things like AWS lambda

alexellisuk 5y ago

Many of the examples you'll find are broken due to changes in Firecracker 1.0 - the official quickstart guide doesn't cover the most interesting thing - working Internet access - or extracting a filesystem from a container. Edit: I've added a link for a live-stream I'll be doing with Richard Case from Weaveworks on use-cases, differences vs. containers and legacy VMs - and a number of demos.

Terretta 5y ago

I find the pre-reqs odd in enumerating bare metal, Digital Ocean, and GCP, while omitting AWS. Firecracker was developed at Amazon Web Services to accelerate the speed and efficiency of services like AWS Lambda and AWS Fargate. Firecracker is open sourced under Apache version 2.0. To read more about Firecracker, check out https://firecracker-microvm.io https://firecracker-microvm.io.

alexellisuk 5y ago
You can get bare-metal instances on AWS :) I've added a link to another repo I maintain that lists all the places I know of to get bare-metal servers. Hope that helps.
rileymichael 5y ago
AWS would fall under “bare metal”, it’s vms do not support nested virtualization (whereas the other listed providers do).