firecracker-containerd vs LXD

firecracker-containerd lets containerd manage containers as Firecracker microVMs, adding isolation through the KVM hypervisor. Potential uses include sandboxing untrusted third-party containers and bin-packing different workloads on multi-tenant hosts. It uses OCI image format where possible. The project includes a control plugin and API, an out-of-process shim runtime, an agent inside the microVM, and a root filesystem image builder. That agent invokes runC through containerd-shim-runc-v1 to create Linux containers inside the microVM. Networking supports pre-created tap devices and tap devices created by CNI plugins such as bridge, ptp, host-local, firewall, and tc-redirect-tap. The software is free under Apache 2.0. Hosts require Linux 4.14 or later, Intel x86_64, and KVM; AMD and Arm are not supported. Building requires git, gcc, Docker CE, and Go 1.23 or later. The guide describes the project as very early, and multi-tenant use is at the user’s own risk.

LXD is an open-source platform for managing system containers and virtual machines on Linux. It brings LXC-based containers and KVM-based virtual machines together, with images for many Linux distributions and Windows virtual machines. Management options include a command line, REST API, web UI and third-party tools; the same HTTP API supports local and remote access. An official web UI is available by default starting with LXD 5.21.0 LTS. Features include resource limits, scheduled and expiring snapshots, projects, hardware passthrough, live migration and advanced networking. Containers run unprivileged by default, and virtual machines support UEFI Secure Boot and vTPM. LXD can run from a laptop to a data-center deployment; documentation describes clusters of up to 50 servers with thousands of instances. LXD is free, with the open-source plan listed at free. Ubuntu Pro Personal is also free for up to five physical Ubuntu systems. Enterprise workstation and server subscriptions are $25 a year and $500 a year, respectively.