“Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant containers and functions-based services.”
One of the great things embedded in Amazon Web Services DNA is their unparalleled vision and innovation in the compute resource space. In the cloud first era, AWS has constantly redefined what a compute resource is and should be. From the very start, AWS provided compute resource in the form of instances (virtualized servers), which quickly became the norm for customer compute resource. In more recent times, this innovation has continued in the form of services like ECS, Fargate, EKS, and Lambda, supported by underlying container technologies such as Docker. A constant theme in this innovation has been the miniaturization of compute resources, shrinking from monolithic instances to containers to serverless functions. Launching and leveraging smaller units of compute resource provides benefits to both AWS and its customers. AWS can distribute, balance and pack these smaller compute units more densely across its global, regional, and zonal physical resources. Customers can optimize their varying usage requirements versus spend equation.
AWS has leveraged container technology as an enabler for much of this miniaturization, providing a key advantage of faster launch times for the compute resource. However, running containers at scale in highly multi-tenanted environments has its own challenges, particularly when it comes to enforcing and ensuring security.
With all this in mind, AWS announced that they have made Firecracker open source at re:Invent 2018. Firecracker is their latest rethink to address the requirements of running multi-tenanted secured micro sized workloads. Firecracker provides a new type of virtualization technology which utilizes Linux KVM (Kernel-based Virtual Machines) and provides a RESTful-based API interface to a virtual machine manager (VMM). Spinning up and configuring microVMs is performed via the RESTful API. With Firecracker, you can launch literally thousands of micro-virtual machines, requiring only 5MiB of memory overhead per VM with sub-second launch time (<125ms). A microVM has all of the advantages typically associated with a virtual machine, but in a smaller and more compact footprint, accomplished without compromising on security and boundary isolation between guests on the same multi-tenanted host.
Firecracker has been designed and developed with the following key tenets :
- Built-In Security: We provide compute security barriers that enable multi-tenant workloads and cannot be mistakenly disabled by customers. Customer workloads are simultaneously considered sacred (shall not be touched) and malicious (shall be defended against).
- Light-weight Virtualization: We focus on transient or stateless workloads over long-running or persistent workloads. Firecracker’s hardware resources overhead is known and guaranteed.
- Minimalist in Features: If it’s not clearly required for our mission, we won’t build it. We maintain a single implementation per capability.
- Compute Oversubscription: All of the hardware compute resources exposed by Firecracker to guests can be securely oversubscribed.
To get Firecracker up and running you’ll need access to a bare metal server running Linux with KVM. AWS provides the i3. metal instance, but you can also run it on your workstation or other provider-supplied bare metal servers. If you’re considering using the i3.metal instance for running Firecracker, take into account the cost of running this beast (36 hyper-threaded cores, 512 GiB, 15.2TB SSD – costing $4.992 per hour On-Demand in Oregon).
From what I can tell having briefly read the docs and played with the technology, there aren’t many, if any, restrictions on what workload types can be processed within a microVM running on Firecracker. Having said that, and as the product name potentially implies, Firecracker’s niche spot is probably aimed at short-lived bursts of compute activity, since this is also evidenced by the fact that both Lambda and Fargate services now use Firecracker under the hood and were likely influencing its design. However, there really is no reason why longer-lived workloads can’t also be processed using this technology.
Let’s quickly summarize Firecracker key features:
- Millisecond launch time can be as low 125ms with 5MiB memory overhead
- Fully fledged micro virtual machines – not just containers
- Ring-fenced security and isolation enforced between microVMs on the same host
- Authored in Rust (https://www.rust-lang.org/)
- Requires Linux and KVM
- Now used internally by Fargate and Lambda
- Open sourced under the Apache version 2.0 license
- Documentation portal: https://firecracker-microvm.github.io/
- Source: https://github.com/firecracker-microvm/firecracker
Firecracker looks to be both promising and popular for provisioning compute resources. In the first 24 hours since announcement, the Firecracker GitHub repository has already accumulated 21 Pull Requests from community contributors, with several more new ones appearing during the time this blog post was authored. Indeed, this latest AWS compute resource innovation has *sparked* a lot of interest.
Go ahead and light the fuse…
Are you at re:Invent this year? Come visit us at booth #1809 and speak to a member of our team to see how we can transform your cloud training.
Top 13 Amazon Virtual Private Cloud (VPC) Best Practices
Amazon Virtual Private Cloud (VPC) brings a host of advantages to the table, including static private IP addresses, Elastic Network Interfaces, secure bastion host setup, DHCP options, Advanced Network Access Control, predictable internal IP ranges, VPN connectivity, movement of interna...
Big Changes to the AWS Certification Exams
With AWS re:Invent 2019 just around the corner, we can expect some early announcements to trickle through with upcoming features and services. However, AWS has just announced some big changes to their certification exams. So what’s changing and what’s new? There is a brand NEW ...
New on Cloud Academy: ITIL® 4, Microsoft 365 Tenant, Jenkins, TOGAF® 9.1, and more
At Cloud Academy, we're always striving to make improvements to our training platform. Based on your feedback, we released some new features to help make it easier for you to continue studying. These new features allow you to: Remove content from “Continue Studying” section Disc...
AWS Security Groups: Instance Level Security
Instance security requires that you fully understand AWS security groups, along with patching responsibility, key pairs, and various tenancy options. As a precursor to this post, you should have a thorough understanding of the AWS Shared Responsibility Model before moving onto discussi...
Cloud Migration Risks & Benefits
If you’re like most businesses, you already have at least one workload running in the cloud. However, that doesn’t mean that cloud migration is right for everyone. While cloud environments are generally scalable, reliable, and highly available, those won’t be the only considerations dri...
Real-Time Application Monitoring with Amazon Kinesis
Amazon Kinesis is a real-time data streaming service that makes it easy to collect, process, and analyze data so you can get quick insights and react as fast as possible to new information. With Amazon Kinesis you can ingest real-time data such as application logs, website clickstre...
Google Cloud Functions vs. AWS Lambda: The Fight for Serverless Cloud Domination
Serverless computing: What is it and why is it important? A quick background The general concept of serverless computing was introduced to the market by Amazon Web Services (AWS) around 2014 with the release of AWS Lambda. As we know, cloud computing has made it possible for users to ...
Google Vision vs. Amazon Rekognition: A Vendor-Neutral Comparison
Google Cloud Vision and Amazon Rekognition offer a broad spectrum of solutions, some of which are comparable in terms of functional details, quality, performance, and costs. This post is a fact-based comparative analysis on Google Vision vs. Amazon Rekognition and will focus on the tech...
New on Cloud Academy: CISSP, AWS, Azure, & DevOps Labs, Python for Beginners, and more…
As Hurricane Dorian intensifies, it looks like Floridians across the entire state might have to hunker down for another big one. If you've gone through a hurricane, you know that preparing for one is no joke. You'll need a survival kit with plenty of water, flashlights, batteries, and n...
Amazon Route 53: Why You Should Consider DNS Migration
What Amazon Route 53 brings to the DNS table Amazon Route 53 is a highly available and scalable Domain Name System (DNS) service offered by AWS. It is named by the TCP or UDP port 53, which is where DNS server requests are addressed. Like any DNS service, Route 53 handles domain regist...
How to Unlock Complimentary Access to Cloud Academy
Are you looking to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Cloud Security, Python, Java, or another technical skill? Then you'll want to mark your calendars for August 23, 2019. Starting Friday at 12:00 a.m. PDT (3:00 a.m. EDT), Cloud Academy is offering c...
What Exactly Is a Cloud Architect and How Do You Become One?
One of the buzzwords surrounding the cloud that I'm sure you've heard is "Cloud Architect." In this article, I will outline my understanding of what a cloud architect does and I'll analyze the skills and certifications necessary to become one. I will also list some of the types of jobs ...