firecracker-containerd
github.com
What it is
firecracker-containerd lets containerd manage containers as Firecracker microVMs, adding isolation through the KVM hypervisor. Potential uses include sandboxing untrusted third-party containers and bin-packing different workloads on multi-tenant hosts. It uses OCI image format where possible. The project includes a control plugin and API, an out-of-process shim runtime, an agent inside the microVM, and a root filesystem image builder. That agent invokes runC through containerd-shim-runc-v1 to create Linux containers inside the microVM. Networking supports pre-created tap devices and tap devices created by CNI plugins such as bridge, ptp, host-local, firewall, and tc-redirect-tap. The software is free under Apache 2.0. Hosts require Linux 4.14 or later, Intel x86_64, and KVM; AMD and Arm are not supported. Building requires git, gcc, Docker CE, and Go 1.23 or later. The guide describes the project as very early, and multi-tenant use is at the user’s own risk.
Spec sheet
- Purpose
- firecracker-containerd enables containerd to manage containers as Firecracker microVMs.Read 4 Oct 2026 · github.com
- Integrations
- The getting-started guide describes CNI plugins including bridge, ptp, host-local, firewall, and tc-redirect-tap.Read 4 Oct 2026 · github.com
- Support
- The README directs bug reports, roadmap discussion, and feature requests to GitHub Issues, and general discussion to the Firecracker Slack #containerd channel.Read 4 Oct 2026 · github.com
- License
- The project is licensed under Apache 2.0.Read 4 Oct 2026 · github.com
- Build prerequisites
- The guide lists git, gcc, Docker CE, and Go 1.23 or later as prerequisites.Read 4 Oct 2026 · github.com
- Components
- The repository includes a control plugin and API, an out-of-process shim runtime, an agent that runs inside the microVM, and a root filesystem image builder.Read 4 Oct 2026 · github.com
- Container compatibility
- The project uses container standards such as the OCI image format where possible.Read 4 Oct 2026 · github.com
- Container runtime
- The in-VM agent invokes runC through containerd's containerd-shim-runc-v1 to create Linux containers inside the microVM.Read 4 Oct 2026 · github.com
- Host requirements
- The getting-started guide requires Linux 4.14 or later, an Intel x86_64 processor, and KVM; it says AMD and Arm are not yet supported by this project.Read 4 Oct 2026 · github.com
- Isolation
- Firecracker microVMs can provide an additional layer of isolation through the KVM hypervisor.Read 4 Oct 2026 · github.com
- Networking
- Networking supports pre-created tap devices and tap devices created automatically by CNI plugins.Read 4 Oct 2026 · github.com
- Production networking
- The guide says production deployments should choose network configuration suited to their environment and workloads, with attention to network isolation between tasks.Read 4 Oct 2026 · github.com
- Project maturity
- The getting-started guide describes the project as being in a very early state and says it is not yet as plug-and-play as desired.Read 4 Oct 2026 · github.com
- Security caveat
- The repository states that multi-tenant use cases are at the user's own risk.Read 4 Oct 2026 · github.com
- Use cases
- The project describes sandboxing untrusted third-party containers and bin-packing disparate workloads on multi-tenant hosts as potential use cases.Read 4 Oct 2026 · github.com
Plans and prices
firecracker-containerd Free Apache-2.0 licensed; requires Linux 4.14+, Intel x86_64, and KVM; project describes itself as in a very early state Read 4 Oct 2026 · github.com
Strong points and limits
Strong points
- Adds KVM-based isolation around containers
- Supports OCI image format
- Offers multiple CNI networking options
- Free under Apache 2.0
- Includes containerd integration components
Limits
- Requires Linux 4.14 or later and KVM
- Intel x86_64 required; AMD and Arm unsupported
- Project is described as very early
- Multi-tenant use is at user’s own risk
Who it suits
It suits Linux operators exploring virtualized container isolation with Firecracker and KVM. Users should be prepared for early-stage software and environment-specific networking work.
Verdict
firecracker-containerd provides a clearly defined path from containerd to Firecracker microVMs and OCI workloads. Its host requirements and early project status make deployment a specialized choice rather than a plug-and-play runtime.
Where Specifiction places it
- Container Runtime Software#14 of 287.8
