4 ms·

I think I understand the use case for firecracker if you're a hosting provider like AWS or Fly.io: you don't want one customer's containers messing with those o

I think I understand the use case for firecracker if you're a hosting provider like AWS or Fly.io: you don't want one customer's containers messing with those of another container. If you're only running your own code, is Firecracker better in some way than just using docker?

alan-hn 5y ago
It offers a greater degree of sandboxing
- rahimnathwani 5y ago
  Right, but if I'm only running my own code, I probably don't care about that, right?
  - alan-hn 5y ago
    Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way. There's also ignite which works with firecracker: https://github.com/weaveworks/ignite https://github.com/weaveworks/ignite
    - kennethh 5y ago
      Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.
      - alexellisuk 5y ago
        Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box. If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail. Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?
  - __turbobrew__ 5y ago
    If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.
    - rahimnathwani 5y ago
      This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...
      - __turbobrew__ 5y ago
        Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs. I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?
  - alexellisuk 5y ago
    It depends. In a container, you can't really run docker itself or full K3s for instance. So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want. Of course, we are covering all this in the live-stream, see the link at the end of the repo!
  - deleted 5y ago
    [deleted]
rad_gruchalski 5y ago
Yes. Firecracker makes sense if you are going to run apps supplied by a third-party. It’s all about isolation. The story with firecracker is that it’s a great tool for rolling out very lightweight vms. It’s for sure production ready. What’s missing is a nicely packaged docker-like set of tools which do not require a bunch of different technologies being glued together. The biggest one being for sure integrated overlay cni… I’ve written a bit on firecracker before: https://gruchalski.com/tags/firecracker/ https://gruchalski.com/tags/firecracker/.
tylergetsay 5y ago
I believe you can suspend a firecracker VM to disk and resume it way faster than starting a container. If I'm not mistaken firecracker powers things like AWS lambda

alan-hn 5y ago

It offers a greater degree of sandboxing

rahimnathwani 5y ago
Right, but if I'm only running my own code, I probably don't care about that, right?
- alan-hn 5y ago
  Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way. There's also ignite which works with firecracker: https://github.com/weaveworks/ignite https://github.com/weaveworks/ignite
  - kennethh 5y ago
    Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.
    - alexellisuk 5y ago
      Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box. If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail. Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?
- __turbobrew__ 5y ago
  If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.
  - rahimnathwani 5y ago
    This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...
    - __turbobrew__ 5y ago
      Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs. I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?
- alexellisuk 5y ago
  It depends. In a container, you can't really run docker itself or full K3s for instance. So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want. Of course, we are covering all this in the live-stream, see the link at the end of the repo!
- deleted 5y ago
  [deleted]

rad_gruchalski 5y ago

Yes. Firecracker makes sense if you are going to run apps supplied by a third-party. It’s all about isolation. The story with firecracker is that it’s a great tool for rolling out very lightweight vms. It’s for sure production ready. What’s missing is a nicely packaged docker-like set of tools which do not require a bunch of different technologies being glued together. The biggest one being for sure integrated overlay cni… I’ve written a bit on firecracker before: https://gruchalski.com/tags/firecracker/ https://gruchalski.com/tags/firecracker/.

tylergetsay 5y ago

I believe you can suspend a firecracker VM to disk and resume it way faster than starting a container. If I'm not mistaken firecracker powers things like AWS lambda