all posts
blog · topic

Firecracker and microVMs

Firecracker is the virtual machine monitor behind AWS Lambda and PandaStack's sandboxes: a minimal KVM-based VMM that boots a Linux guest with its own kernel in milliseconds. These posts explain how microVMs work, how they compare with containers, gVisor and Kata, and what it takes to run them as a platform.

Firecracker microVM sandboxes

190 posts

·11 min read

Best bare metal providers for Firecracker in 2026

Firecracker needs /dev/kvm, and that one requirement disqualifies most of the cheap compute on the market. The three tiers of hosting that can actually run it, what each gets wrong, and the 60-second check to run before you sign anything.

firecrackerbare-metalinfrastructure
Ajay Kumar
·11 min read

Letting Customers Run Their Own Container Image

“Bring your own container image” is a remote-code-execution endpoint with a product manager attached. The admission pipeline, the baked-RAM surprise, and why the escape surface you just inherited belongs to the kernel rather than to Docker.

containersocimulti-tenancy
Ajay Kumar
·10 min read

firecracker-containerd: Running OCI Images in MicroVMs, and What It Costs You

It lets you keep your images, your registry and your containerd tooling, and swap the thing at the bottom for a microVM. That is a genuinely small diff for a large change in blast radius — and it is still the wrong tool if what you wanted was a fast sandbox API.

firecrackercontainerdoci
Ajay Kumar
·10 min read

Firecracker vs FreeBSD Jails: Two Honest Answers to the Same Question

Jails predate Linux containers by a decade and are better designed than them. They also share the host kernel, which is the entire comparison. Everything else is downstream of that one sentence.

freebsdjailsfirecracker
Ajay Kumar
·10 min read

Can Firecracker Run Windows? No, and the Reason Is the Point

The answer is no, and it is not an oversight or a roadmap item. It falls out of the one decision that makes a microVM boot in milliseconds — and the set of guests Firecracker does support tells you exactly why.

firecrackerwindowsmicrovm
Ajay Kumar
·11 min read

Firecracker vs VMware ESXi: the Device Model Decides

Both words mean "hypervisor," and that is the last thing they have in common. ESXi's value is an enormous device model and a datacenter control plane; Firecracker's value is having neither. The whole comparison lives in that one trade.

firecrackervmwareesxi
Ajay Kumar
·10 min read

Skipping DHCP: the Firecracker boot line you actually ship

Everybody ships the same eleven-token Firecracker kernel command line and nobody measures it. Ours is four tokens plus a generated ip= that skips DHCP entirely — here is how to work out which tokens are buying you anything, and why the answer changes completely once you restore snapshots instead of booting.

firecrackerkernelmicrovm
Ajay Kumar
·11 min read

Bare metal vs cloud VMs for running Firecracker

If you run microVMs, you run a hypervisor — and the layer underneath it is an architecture decision, not a procurement detail. Nested virt taxes every exit and every page fault; bare metal hands you the machine and the pager. Here is the ledger I actually use.

firecrackerbare-metalnested-virtualization
Ajay Kumar
·10 min read

Running Firecracker Under Nomad

Nomad will happily place a Firecracker microVM on a host, restart it, and register it in Consul. It will not clone your rootfs, build your network, restore your snapshot, or notice that the guest inside your perfectly healthy VMM process has been wedged for ten minutes.

nomadfirecrackerorchestration
Ajay Kumar

More posts in this topic