crosvm vs Firecracker

crosvm is a free, open-source virtual machine monitor written in Rust for running Linux and Android guest systems in sandboxed environments. Developed for ChromeOS, it is also used in TerminalApp on Android, Cuttlefish, and Windows. Each virtual device runs in its own Minijail sandbox by default, with syscall policies, namespaces, seccomp filters, and dropped capabilities contributing to isolation. Supported CPU architectures are x86_64, aarch64, and riscv64. The project lists KVM, Gunyah, GenieZone, and Halla for Linux or Android, and WHPX and HAXM for Windows. Virtio devices cover networking, storage, GPU, audio, filesystems, console, RNG, ballooning, vsock, TPM, and video. Block storage supports raw, qcow2, zstd, and Android sparse formats. Linux hosts need kernel 4.14 or newer with KVM support; some devices have additional host requirements. The project documents obtaining crosvm from its source repository and building it with Cargo. SCSI, video, shared host directories via virtio-pmem, and snapshotting are marked experimental or highly experimental.

Firecracker is open-source virtualization software for running container and function workloads in lightweight microVMs. It uses Linux KVM hardware virtualization to isolate each workload and exposes only five emulated devices, a design intended to reduce attack surface. MicroVMs start in under 125 ms, add under 5 MiB of memory overhead each, and a host can create up to 150 per second while packing thousands onto one server. A RESTful API configures and starts the VMs, while rate limiters govern network and storage bandwidth and operations. The companion jailer adds Linux user-space security barriers. Firecracker supports Linux hosts and guests with kernel versions 4.14 and above, plus OSv guests, on production 64-bit Intel, AMD, and Arm CPUs with hardware virtualization. VM snapshots are supported, but GPU acceleration is not. It is free under Apache 2.0, with integrations including containerd, Kata Containers, and Fly.io.