firecracker-init-lab
Build a microVM from a container image
Many of the examples you'll find are broken due to changes in Firecracker 1.0 - the official quickstart guide doesn't cover the most interesting thing - working Internet access - or extracting a filesystem from a container. This lab extends the official quickstart so that you can explore what an init process does, and add networking.
Pre-reqs
- A bare-metal Linux host - where can you get bare metal?
- Or a VM that supports nested virtualisation such as on DigitalOcean or GCP.
- Docker installed
Browse:
- Go init process
- Makefile
- boot.sh - commands to start MicroVM
- Dockerfile - for building the root filesystem
Usage
Download and install Firecracker to /usr/local/bin/
Or, alternatively, Arkade can do this for you with:
curl -SLs https://get.arkade.dev | sudo sh
sudo arkade system install firecracker
Edit the IFNAME in setup-networking.sh to match your host's network interface.
Then run the script to create the ftap0 device, and to setup IP masquerading with iptables:
./setup-networking.shDownload the quickstart Kernel:
make kernel
Make the init process binary, and package it into a container, extract the container into a rootfs image:
make allIn one terminal, start firecracker:
make startIn another, instruct it to boot the rootsfs and Kernel:
make bootPlay around in the first terminal and explore the system:
free -m
cat /proc/cpuinfo
ip addr
ip route
ping -c1 1.1.1.1
echo "nameserver 1.1.1.1" > /etc/resolv.conf
ping -c 4 google.com
apk add --no-cache curl
curl -i https://inlets.devExpose a TCP or HTTP service to the Internet
Once you've got something interesting running like a HTTP server, or an SSHD daemon, you can then get ingress from the public Internet using an inlets tunnel. Inlets is a static binary, and there are a couple of simple tutorials you can follow depending on what you want to expose.
Running on a Raspberry Pi
Edit Makefile, and change arch to aarch64
export arch="x86_64"Live-event - A cracking time with Richard Case of Weaveworks
Richard Case will join me as we explain to you why we're so excited about Firecracker, what use-cases we see and try to show you a little of what can be done with it. Richard's been at the sharp end of this technology for months, and is working on a cutting edge bare-metal Kubernetes project called Liquid Metal.
You'll hear more about it on Friday lunch at 12:00pm BST.
If you can't make it live, then you'll be able to jump onto the replay with your morning coffee.
Faster, more secure CI with Firecracker and actuated
We demoed actuated for fast and secure CI with Firecracker, since then it's being used in production and has launched over 100k VMs so far.
Read more on the website, on the blog or in the docs at: actuated.dev.
Watch a demo: