Sandbox profile · Open-source project

Firecracker

Answer in brief

The KVM-based microVM monitor from AWS that underpins Lambda and Fargate, and the sandboxes of E2B, Vercel, Fly.io, Koyeb and Northflank. The reference microVM primitive for sandbox platforms; choose it when you are building a platform rather than consuming one.

By the Agent Sandboxes editors · Updated November 9, 2026

Overview

Firecracker is a virtual machine monitor written in Rust by developers at Amazon Web Services and released under Apache-2.0 (crosvm-derived sections under BSD-3-Clause). It runs in user space on a Linux host and uses KVM to create microVMs, each with its own guest kernel; the project describes itself as "purpose-built for creating and managing secure, multi-tenant container and function-based services". A Firecracker process exposes an OpenAPI-specified REST API over a socket through which you configure vCPUs, memory, block and network devices, then boot the guest. The companion jailer applies cgroup and namespace isolation and drops privileges as "a second line of defense in case the virtualization barrier is ever compromised". Hosts need 64-bit Intel, AMD or Arm CPUs with hardware virtualisation; guests are Linux kernels 4.14 and above.

Firecracker is the primitive under much of the hosted sandbox market. AWS says it developed Firecracker for AWS Lambda and AWS Fargate, and the project site lists E2B, Fly.io, Koyeb, Northflank, Kata Containers, OpenNebula and Qovery among users and integrations. E2B states that "Every session receives a hardware-isolated Firecracker microVM", and Vercel documents that "Each sandbox runs in a secure Firecracker microVM with its own filesystem and network". Snapshot and restore are built in, which is what makes pause/resume and forking on those platforms possible. There is no managed service: you supply hosts with KVM, kernels, root filesystems and an orchestrator. Releases arrive roughly every two to three months; v1.18.0 was published on 9 November 2026.

Notable

Developed at AWS for AWS Lambda and AWS Fargate; the project site says the same virtualisation sits behind "15 trillion+ monthly Lambda function invocations"
Specification targets: VMM memory overhead of 5 MiB or less per microVM (1 vCPU, 128 MiB RAM) and guest boot of 125 ms or less; the site also claims "Create up to 150 microVMs per second per host"
v1.18.0 released 9 November 2026; diff snapshots remain in developer preview

Firecracker specifications

Attribute	Details
Isolation	KVM-based microVM with its own guest kernel; the VMM exposes a minimal device set (virtio-net, virtio-block, virtio-vsock, serial console, keyboard controller) and a companion jailer adds cgroup, namespace and seccomp barriers
Deployment	Open-source project · Self-hostable
Open source	Yes (Apache-2.0)
SDKs and interfaces	REST API, CLI
Cold start (vendor claim)	Specification target: 125 ms or less from the InstanceStart API call to guest /sbin/init, with the serial console disabled and a minimal kernel and root filesystem; VMM process start within 8 CPU ms
Max session length	Not documented
Persistence	Pause/resume through the /vm API; full snapshots serialise guest memory and device state so a microVM can be restored in another Firecracker process on an identical hardware and software setup; diff snapshots (dirty memory only) are in developer preview
GPU	No - no GPU device is emulated; the device set is limited to virtio-net, virtio-block, virtio-vsock, entropy, pmem, balloon, serial console and keyboard controller
Networking	virtio-net interfaces attached to host tap devices by the embedder, with built-in rate limiters for bandwidth and operations per second
Pricing	Free and open source
Free tier	Free to self-host
Compliance	Not documented
Regions	Not documented

Facts from Firecracker’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

You want the same microVM boundary that E2B, Vercel Sandbox, Fly.io and AWS Lambda use, on your own hardware
You need pause/resume and memory snapshots to fork or checkpoint sandboxes
You run Linux hosts with KVM and can build your own orchestration layer
You want a small, Rust-based VMM with a documented security model (jailer, seccomp, rate limiters)

Trade-offs

Requires KVM and hardware virtualisation on the host, so it does not run on macOS or inside most cloud VMs without nested virtualisation
No GPU passthrough or graphics device
A VMM only: you must provide guest kernels, root filesystems, networking and a control plane yourself
Snapshots must be restored on an identical hardware and software configuration, and network connections are not guaranteed to survive a resume

Good fit for: Building your own microVM sandbox fleet on Linux hosts with KVM.

Use cases Firecracker fits

Open source & self-hosted: The AWS-built microVM monitor that E2B, Vercel Sandbox, Fly.io and Koyeb build on, if you want to build your own.

How Firecracker compares

Sandbox	Isolation	Open source	Self-host / BYOC	Cold start (vendor)	Max session	Snapshots / pause	GPU	SDKs
Firecracker	KVM microVM	Yes	Yes / No	<125 ms (spec)	Not documented	Yes / Yes	No	REST API, CLI
Kata Containers	VM per pod	Yes	Yes / No	Not documented	Not documented	Not documented / Not documented	Yes	CLI
libkrun	In-process microVM	Yes	Yes / No	Not documented	Not documented	Not documented / Not documented	Yes	Rust, C
gVisor	User-space kernel	Yes	Yes / No	ms (claim)	Not documented	Yes / Not documented	Yes	CLI
E2B	Firecracker microVM	Yes	Yes / Yes	Not documented	1 h / 24 h (Pro)	Yes / Yes	No	Python, JavaScript/TypeScript
Fly Machines	Firecracker microVM	No	No / No	<1 s start (claimed)	Not documented	Yes / Yes	Not documented	Go, CLI, REST API
AWS Lambda MicroVMs	Firecracker microVM	No	No / No	sub-second to seconds (claimed)	8 h	Yes / Yes	No	Python, JavaScript/TypeScript, PHP, CLI, REST API

See all Firecracker alternatives →

Frequently asked questions

What is Firecracker?

How does Firecracker isolate code?

Firecracker documents its isolation as: KVM-based microVM with its own guest kernel; the VMM exposes a minimal device set (virtio-net, virtio-block, virtio-vsock, serial console, keyboard controller) and a companion jailer adds cgroup, namespace and seccomp barriers.

Is Firecracker open source?

Yes (Apache-2.0). It can be self-hosted.

How much does Firecracker cost?

Free and open source Check the official pricing page for current rates.

What are the alternatives to Firecracker?

Common alternatives include Kata Containers, libkrun, gVisor, E2B, Fly Machines, AWS Lambda MicroVMs. See Firecracker alternatives for a full comparison.

Sources

Cite this page

Agent Sandboxes. (2026). Firecracker. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/firecracker/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.