Firecracker
microvmvmmopen sourceAWS's minimal virtual machine monitor that boots a with its own kernel in ~125ms, built for running untrusted multi-tenant code.
documentedFirecracker homepage ↗
Firecracker is the userspace behind AWS Lambda and Fargate. It drives KVM, emulates only the minimum devices, and confines itself with a seccomp allowlist plus a (chroot, namespaces, cgroups, privilege drop), the 'second wall' that contains a compromised . Each has its own guest kernel behind a hardware boundary.
Strengths
- Hardware boundary with ~125ms boot and ~5MiB memory overhead
- Ships its own second wall: seccomp allowlist + jailer
- Battle-tested at Lambda/Fargate scale on hostile multi-tenant code
Limitations
- Requires KVM, bare metal or nested virtualization
- Minimal device model by design; no GPU passthrough story
- A building block, not a dev tool, needs orchestration around it
- No documented upstream fuzzing infrastructure, so its published-CVE record rests on less automated search than gVisor's; it also took an escape-class CVE in 2026 (CVE-2026-5747, CVSS 8.7, OOB write in virtio-pci)
- Being a building block means somebody downstream chooses which build you run, which is where the real exposure has been, see the e2b entry
VMM second wall
VMM second wall: fullseccomp allowlist on the vCPU threads plus a jailer (namespaces, cgroups, chroot, privilege drop).
The second wall confines the VMM itself, so a compromised device backend can't own the host. It's separate from the hardware boundary every microVM already has. The two walls, explained.