- Home
- Container Runtime Software
- firecracker-containerd
firecracker-containerd
What it is
firecracker-containerd lets containerd run containers as Firecracker microVMs. The project describes the microVM boundary and KVM hypervisor as an additional isolation layer, with possible uses including sandboxing untrusted third-party containers and bin-packing different workloads on multi-tenant hosts. It uses OCI image format where possible. The repository includes a control plugin and API, an out-of-process shim, an in-VM agent and a root filesystem image builder. That agent invokes runC through containerd-shim-runc-v1 to create Linux containers inside each microVM. Networking supports pre-created tap devices or taps created by CNI plugins such as bridge, ptp, host-local, firewall and tc-redirect-tap. The software is free under Apache 2.0. It requires Linux 4.14 or later, Intel x86_64 and KVM; AMD and Arm are not supported. Building requires git, gcc, Docker CE and Go 1.23 or later. The guide calls the project very early-stage and warns multi-tenant use is at the user's own risk.
For and against
For
- Free Apache 2.0 license
- OCI image support
- KVM-based microVM isolation
- CNI networking options
- Linux containerd integration
Against
- Requires Linux 4.14+, Intel x86_64 and KVM
- AMD and Arm are unsupported
- Project is described as very early
- Multi-tenant use carries user risk
The verdict
firecracker-containerd provides a containerd-to-microVM path with OCI compatibility and configurable networking. Its hardware limits and early maturity make setup and production decisions important.
Who it suits
It is for Linux users running containerd who need virtualized container isolation or sandboxing and can meet its host requirements.
Plans and prices
firecracker-containerd
Apache-2.0 licensed; requires Linux 4.14+, Intel x86_64, and KVM; project describes itself as in a very early state
Read 4 Oct 2026 · github.com
On the record
- Build prerequisites
- The guide lists git, gcc, Docker CE, and Go 1.23 or later as prerequisites.github.com · read 4 Oct 2026
- Components
- The repository includes a control plugin and API, an out-of-process shim runtime, an agent that runs inside the microVM, and a root filesystem image builder.github.com · read 4 Oct 2026
- Container compatibility
- The project uses container standards such as the OCI image format where possible.github.com · read 4 Oct 2026
- Container runtime
- The in-VM agent invokes runC through containerd's containerd-shim-runc-v1 to create Linux containers inside the microVM.github.com · read 4 Oct 2026
- Host requirements
- The getting-started guide requires Linux 4.14 or later, an Intel x86_64 processor, and KVM; it says AMD and Arm are not yet supported by this project.github.com · read 4 Oct 2026
- Integrations
- The getting-started guide describes CNI plugins including bridge, ptp, host-local, firewall, and tc-redirect-tap.github.com · read 4 Oct 2026
- Isolation
- Firecracker microVMs can provide an additional layer of isolation through the KVM hypervisor.github.com · read 4 Oct 2026
- License
- The project is licensed under Apache 2.0.github.com · read 4 Oct 2026
- Networking
- Networking supports pre-created tap devices and tap devices created automatically by CNI plugins.github.com · read 4 Oct 2026
- Production networking
- The guide says production deployments should choose network configuration suited to their environment and workloads, with attention to network isolation between tasks.github.com · read 4 Oct 2026
- Project maturity
- The getting-started guide describes the project as being in a very early state and says it is not yet as plug-and-play as desired.github.com · read 4 Oct 2026
- Purpose
- firecracker-containerd enables containerd to manage containers as Firecracker microVMs.github.com · read 4 Oct 2026
- Security caveat
- The repository states that multi-tenant use cases are at the user's own risk.github.com · read 4 Oct 2026
- Support
- The README directs bug reports, roadmap discussion, and feature requests to GitHub Issues, and general discussion to the Firecracker Slack #containerd channel.github.com · read 4 Oct 2026
- Use cases
- The project describes sandboxing untrusted third-party containers and bin-packing disparate workloads on multi-tenant hosts as potential use cases.github.com · read 4 Oct 2026
