LoginSign Up
← Back to all sparks
F

Firecracker

INFRA · APIS
Velocity0.0

Secure and fast microVM manager for serverless workloads

firecracker-microvm.github.io ↗

Firecracker's microVMs can now grow and shrink devices while running.

microvmdevice hotplugsnapshotspci transportvirtio
◆Current state
1.16.0 in June added developer-preview hotplug and hot-unplug for PCI virtio block, pmem and net devices on a live microVM, with the guest responsible for rescanning the bus and removing the device first since no notification mechanism exists yet. The same release added vsock Unix socket path overriding on snapshot restore, rate limiting for serial console output with a dropped-bytes metric, and per-callsite log rate limiting. 1.16.1 followed with a vsock fix for connections timing out after restore when a snapshot caught an in-flight TX descriptor. Earlier in the window, 1.15.0 added the VMClock device and Intel Granite Rapids support, and the April patches hardened the PCI transport against CVE-2026-5747.
◆Where it's heading
The through-line is snapshots and the PCI transport maturing together. Firecracker's value has always been fast boot from a snapshot, and the recent fixes are all in the seams that opens up — TX descriptors in flight when a snapshot is taken, vsock paths that change on restore, virtio device state machines that must be validated the same way on PCI as on MMIO. Hotplug extends the same idea from restore-time to run-time: a microVM that can change shape is one you can keep rather than replace.
◆Prediction
Hotplug shipped explicitly as a developer preview requiring manual guest bus rescans, so the stated gap is an automatic notification mechanism. That is the obvious next step before the feature leaves preview.

◆Recent moves

  1. 1mo ago

    Vsock timeout after snapshot restore, and jailer symlink revert

    Reverts O_NOFOLLOW on the jailer's cgroup and network namespace paths so symlinks work again, and fixes vsock guest-to-host connections timing out after snapshot restore by replaying the TX queue notification for descriptors that were in flight when the snapshot was taken.

    View source ↗
  2. 2mo ago

    Firecracker v1.16.0

    ⚡ SPARK

    Developer-preview hotplug and hot-unplug of PCI virtio block, pmem and net devices on a running microVM, plus vsock socket path overriding on restore and rate limiting for serial output and logs. A microVM that can change its device set while running is a different unit of infrastructure from one that cannot.

    View source ↗
  3. 4mo ago

    virtio-rng entropy cap and PCI transport hardening (CVE-2026-5747)

    Caps virtio-rng per-request entropy at 64 KiB to stop a guest forcing outsized host allocations, and enforces the virtio initialisation sequence in the PCI transport to match MMIO — validating status transitions, rejecting out-of-window queue configuration and feature negotiation, and blocking re-initialisation after a failed reset. Fixes CVE-2026-5747.

    View source ↗
  4. 4mo ago

    CVE-2026-5747 hardening on the 1.15 branch

    The 1.15 branch's copy of the same virtio-rng cap and PCI transport hardening released on the 1.14 branch the same day. Same changes, parallel branch.

    View source ↗
  5. 4mo ago

    TCP SYN options length validation with MMDS enabled

    Fixes validation of TCP SYN options length when MMDS is enabled. A single narrow fix.

    View source ↗
  6. 5mo ago

    VMClock device and Intel Granite Rapids support

    Adds the VMClock device with the proposed snapshot-safety behaviour, though not yet any clock information for guest synchronisation, and brings Intel Granite Rapids in as a supported platform. The VMClock costs one GSI, lowering the virtio device ceiling to 92 on Aarch64 and 17 on x86.

    View source ↗