firecracker-microvm/firecracker-containerd

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2910 stars · 244 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

firecracker-containerd is a set of components that lets containerd manage containers running inside Firecracker microVMs, combining fast container-style startup with KVM-based hypervisor isolation. It includes a control plugin, an out-of-process shim runtime, an in-VM agent, and a root filesystem image builder.

Use cases

• sandbox untrusted third-party containers in their own microVM
• bin-pack container workloads on a host with strong isolation
• run multi-tenant workloads with hypervisor-level isolation
• run OCI containers with Firecracker microVMs via containerd
• achieve high container density without sacrificing isolation

When to choose

• you already use containerd and need stronger isolation than kernel-based runtimes
• you run partially or fully untrusted containers and want to protect host secrets
• you need fast-starting, low-overhead microVMs for multi-tenant hosting

When to avoid

• you need a general-purpose container runtime without microVM overhead
• your workloads are fully trusted and standard runc isolation suffices
• you need a solution supported on non-Linux hosts or without KVM

Facets

library · maturity active

container-runtime container-orchestration security cloud-computing security developer-tools go cloud firecracker microvm containerd sandboxing kvm oci multi-tenancy serverless virtualization containers linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="firecracker-microvm/firecracker-containerd")