Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firecracker: Secure and fast microVMs for serverless computing

firecracker-microvm.github.io

Post reply on HN
Print view View original

11–20 of 107 posts

Re: Firecracker: Secure and fast microVMs for serverless computing

#11

Post by _alex_ »

karambahh wrote: post #5
rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

I am actually surprised by the absence of AMD support for a project born at AWS. AWS has been offering AMD Epyc ec2 instances for quite awhile[0]. Missing arm support is also suprising but less so, as arm market penetration is obviously lower than x64 [0] https://aws.amazon.com/fr/ec2/amd/

the vast majority of EC2 is intel. It's not surprising that AMD support is coming after intel support

Re: Firecracker: Secure and fast microVMs for serverless computing

#12

Post by tofflos »

I played with Weave Ignite the other day which is a Docker-like CLI for Firecracker. Sure there were some rough edges but the overall experience was pretty good. If you are familiar with the Docker CLI you will be able to get some virtual machines up and running very quickly.

Two questions in case someone from Weave tunes into the discussion:

I got the impression that VMs needed an SSH server to be accessible. Is this correct and if so will it be possible to implement something similar to docker exec so that I won't need an SSH server on every VM?

> At the moment ignite and ignited need root privileges on the host to operate due to certain operations (e.g. mount). This will change in the future.

Is there a timetable and could you perhaps elaborate a bit as to why it currently requires root? (I don't know anything about virtual machine internals so this isn't a passive-aggressive question from my side. It's genuine curiosity.)

Re: Firecracker: Secure and fast microVMs for serverless computing

#13

Post by bennyz »

ausjke wrote: post #10

docker is used for microservices, is firecraker designed for serverless applications? what's the key difference between firecracker and docker? are these two overlapped?

Amazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.

Re: Firecracker: Secure and fast microVMs for serverless computing

#14

Post by solarkraft »

bennyz wrote: post #13
ausjke wrote: post #10

docker is used for microservices, is firecraker designed for serverless applications? what's the key difference between firecracker and docker? are these two overlapped?

Amazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.

Why does FaaS (that's what Lambda is, right?) need more full blown virtualization? I thought you could maybe get away with even lighter separation than Docker?

Re: Firecracker: Secure and fast microVMs for serverless computing

#15

Post by otterley »

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

(I work for AWS, but not on the Firecracker team. Opinions are my own and not of the company.)

Firecracker is open source. We welcome community contributions to bring the technology to additional CPU architectures.

Also, as other commenters have noted, AMD support is already in-tree. It's just in Developer Preview, which indicates the relative level of maturity.

AWS does not have any RISC-V processors in its EC2 offering portfolio, but if customers are demanding them, we'd love to hear from you - please reach out to your account team.

Re: Firecracker: Secure and fast microVMs for serverless computing

#16

Post by DenseComet »

mrkurt wrote: post #3

Firecracker is great We use it to run fleets of fast booting vms at https://fly.io . It’s really the best OSS to come out of Amazon.

I played around with fly.io for a bit, it seems pretty interesting. It works pretty well too, I went through the setup for the DoH proxy and the latency I get is very similar to Cloudflare itself, so that's pretty awesome.

It seems that the autoscaling limits are only defined in the fly.toml with the soft and hard limits? It might be useful to make this easily visible under flyctl scale. Also if I delete the fly.toml, can I regenerate it easily?

As a sidenote, I was looking around for more information on the platform and looking at old hn posts. I know the company pivoted a couple of times, but all the old articles are 404ing because the blog url changed.

Re: Firecracker: Secure and fast microVMs for serverless computing

#17

Post by lfischer »

solarkraft wrote: post #14
bennyz wrote: post #13

Earlier quoted context omitted.

Amazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.

Why does FaaS (that's what Lambda is, right?) need more full blown virtualization? I thought you could maybe get away with even lighter separation than Docker?

AWS needs to separate one customer’s lambda executions from another’s. When you deploy Docker, isolation is guaranteed either because you do it on an underlying dedicated VM, or you give the Docker image to something like Fargate.

Re: Firecracker: Secure and fast microVMs for serverless computing

#19

Post by [deleted] »

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

[deleted]

Re: Firecracker: Secure and fast microVMs for serverless computing

#20

Post by bronxbomber92 »

solarkraft wrote: post #14
bennyz wrote: post #13

Earlier quoted context omitted.

Amazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.

Why does FaaS (that's what Lambda is, right?) need more full blown virtualization? I thought you could maybe get away with even lighter separation than Docker?

I know very little about the actual technology, but I feel like the blurb on their front page explains this succinctly:

“ Firecracker enables you to deploy workloads in lightweight virtual machines, called microVMs, which provide enhanced security and workload isolation over traditional VMs, while enabling the speed and resource efficiency of containers”

Security of a VM + efficiency of a container.

Post reply on HN