Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firecracker: Secure and fast microVMs for serverless computing

firecracker-microvm.github.io

Post reply on HN
Print view View original

21–30 of 107 posts

Re: Firecracker: Secure and fast microVMs for serverless computing

#21

Post by fiddlerwoaroof »

solarkraft wrote: post #14
bennyz wrote: post #13

Earlier quoted context omitted.

Amazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.

Why does FaaS (that's what Lambda is, right?) need more full blown virtualization? I thought you could maybe get away with even lighter separation than Docker?

Docker isn’t really designed to be a security boundary, so if you’re colocating containers from different customers (e.g. in Fargate), you need to separate them with a real security boundary like a VM. The same thing is true for lambdas: a lambda is just an archive and the code in the archive needs to run somewhere where one customer cannot intercept another customer’s data.

Re: Firecracker: Secure and fast microVMs for serverless computing

#22

Post by legulere »

tofflos wrote: post #12

I played with Weave Ignite the other day which is a Docker-like CLI for Firecracker. Sure there were some rough edges but the overall experience was pretty good. If you are familiar with the Docker CLI you will be able to get some virtual machines up and running very quickly. Two questions in case someone from Weave tunes into the discussion: I got the impression that VMs needed an SSH server to be accessible. Is thi…

At least crosvm which this is based on offers serial device emulation.

Re: Firecracker: Secure and fast microVMs for serverless computing

#23

Post by jeromegn »

DenseComet wrote: post #16
mrkurt wrote: post #3

Firecracker is great We use it to run fleets of fast booting vms at https://fly.io . It’s really the best OSS to come out of Amazon.

I played around with fly.io for a bit, it seems pretty interesting. It works pretty well too, I went through the setup for the DoH proxy and the latency I get is very similar to Cloudflare itself, so that's pretty awesome. It seems that the autoscaling limits are only defined in the fly.toml with the soft and hard limits? It might be useful to make this easily visible under flyctl scale. Also if I delete the fly.toml…

That's nice to read! Thanks.

We do need to cleanup our old blog posts and links. We created a lot of content at various times. This content is not always relevant anymore.

As for your fly.toml question, you can get the config with `flyctl config save -a your-app`. It'll create a fly.toml with the latest config we know about.

Concurrency limits are still being worked on. They should definitely be visible in more places. The only way to know about them right now is from the fly.toml, that's not ideal.

Re: Firecracker: Secure and fast microVMs for serverless computing

#24

Post by bennyz »

tofflos wrote: post #12

I played with Weave Ignite the other day which is a Docker-like CLI for Firecracker. Sure there were some rough edges but the overall experience was pretty good. If you are familiar with the Docker CLI you will be able to get some virtual machines up and running very quickly. Two questions in case someone from Weave tunes into the discussion: I got the impression that VMs needed an SSH server to be accessible. Is thi…

>Is there a timetable and could you perhaps elaborate a bit as to why it currently requires root? (I don't know anything about virtual machine internals so this isn't a passive-aggressive question from my side. It's genuine curiosity.)

Not from Weave, but I might have an idea as I've played with Firecracker a bit. When you start up a Firecracker VM, you need to provide it with a rootfs drive, which is a file containing the root file system to be used for the VM. Ignite uses OCI images, so I guess they are doing something similar to [1] in code, the `mount` part requires sudo, so that would be my guess to why you need root.

[1] https://github.com/firecracker-microvm/firecracker/blob/mast...

Re: Firecracker: Secure and fast microVMs for serverless computing

#27

Post by dang »

pimlottc wrote: post #25

> Firecracker: OSS virtualization techno, creating and managing secure, multi-tena This title is a bit awkwardly worded; in particular, "techno" in American English is a genre of music, not an abbreviation for "technology".

We've reverted it now. Submitted title was "Firecracker: OSS virtualization techno, creating and managing secure, multi-tena".

Submitters: please don't do that—this is in the site guidelines: https://news.ycombinator.com/newsguidelines.html. If a title is misleading or baity, please rewrite it, but please also make it good English.

Re: Firecracker: Secure and fast microVMs for serverless computing

#29

Post by mrkurt »

michael_j_ward wrote: post #18
mrkurt wrote: post #3

Firecracker is great We use it to run fleets of fast booting vms at https://fly.io . It’s really the best OSS to come out of Amazon.

What do you use for orchestration?

Nomad + our own firecracker task driver. There's a promising open source task driver for Firecracker as well (ours does a ton that's specific to our networking setup): https://nomadproject.io/docs/drivers/external/firecracker-ta...

Re: Firecracker: Secure and fast microVMs for serverless computing

#30

Post by ausjke »

ausjke wrote: post #10

docker is used for microservices, is firecraker designed for serverless applications? what's the key difference between firecracker and docker? are these two overlapped?

even questions like this got downvoted, time to leave HN for reddit for good, more and more pathetic here these days indeed.
Post reply on HN