Firecracker is superb! In fact, we run a hardened fork of it in production. But Firecracker is a virtual machine monitor: software that creates and runs virtual machines. A platform is everything wrapped around it like the guest, the snapshots, the orchestration, the density, and the team that keeps it patched. Here is exactly what that difference looks like.
- Under 10 ms cold start for any workload
- 100K+ microVMs per server
- 10–100× better unit economics
A VMM does not make an entire platform
Grab Firecracker and you get the isolation boundary. Everything above it (click a layer on the right to see what it does) is what you would otherwise design, build, operate, and patch yourself.
Deploy · BYOC · on-prem · support
Run the whole platform on bare metal or cloud VMs — on-prem, bring-your-own-cloud, or dedicated hosts. You own the full stack. SOC 2 and HIPAA compliant, with engineers on call.
Kubernetes — Kraftlet virtual node
Drop Unikraft into an existing EKS/GKE/AKS cluster as a node. Schedule ordinary pods, but have them run as strongly-isolated microVMs that scale to zero in milliseconds.
Orchestration — autoscale · live migration
Scale to zero and statefully resume in milliseconds. Spin up a fleet of new hosts in under 20 seconds to absorb spikes. Live-migrate running VMs across servers for HA and maintenance.
Snapshot — fork · template · checkpoint
Branch a live VM and its children in ~10 ms. Spawn thousands of instances from a template. Take named, restorable checkpoints, rewind a running VM in place, and launch new VMs from any point in history — all in milliseconds. Upstream Firecracker has none of this at this granularity.
Persistent shared storage
Cluster-wide volumes shared seamlessly by VMs running on different servers.
Guest OS — minimal Linux
A Dockerfile becomes your own trimmed-down Linux kernel. The guest boots in a few milliseconds. A stock Linux guest on raw Firecracker needs ~330 ms+ just to reach userspace.
The Unikraft platform provides the full stack:
- Deploy (BYOC, hosted, or on-prem) and get support: Run the whole platform on bare metal or cloud VMs, deploy on-prem, bring-your-own-cloud, or on dedicated hosts. You own the full stack. SOC 2 and HIPAA compliant, with engineers on call.
- Kubernetes via Kraftlet virtual node: Drop Unikraft into an existing EKS/GKE/AKS cluster as a node. Schedule ordinary pods, but have them run as strongly-isolated microVMs that scale to zero in 10 ms.
- Orchestration, autoscale, and live migration: Scale to zero and statefully resume in under 10 ms. Spin up a fleet of new hosts in under 20 s to absorb spikes. Live-migrate running VMs across servers for HA and maintenance.
- Snapshot, fork, template, and checkpoint: Branch a live VM and its children in ~10 ms. Spawn thousands of instances from a template. Take named, restorable checkpoints, rewind a running VM in place, and launch new VMs from any point in history — all in milliseconds. Upstream Firecracker has none of this at this granularity.
- Persistent shared storage: Cluster-wide volumes shared seamlessly by VMs running on different servers.
- Guest OS (minimal Linux): A Dockerfile becomes your own trimmed-down Linux kernel. The guest boots in a few ms. A stock Linux guest on raw Firecracker needs ~330 ms+ just to reach userspace.
- Hardened Firecracker fork: The isolation boundary: a fast, minimal device model with VM-grade security. This one layer is exactly where “just grab Firecracker” stops — and even here we run a hardened fork.
What’s actually included
| Capability | Raw Firecracker (DIY) | Unikraft |
|---|---|---|
| Speed Cold start to ready | — Boot a full guest OS, ~330 ms+ | ✓ <10 ms, any workload |
| Speed Scale to zero + resume | — Not included | ✓ Stateful resume <10 ms |
| Func Fork a live VM | — Not included | ✓ ~10 ms, children too |
| Func Templates — spawn N | — Build it yourself | ✓ 1,000s of templates |
| Func Checkpoint & restore | — Basic pause/resume only | ✓ Named history + in-place rewind |
| Func Build from Dockerfile | — Bring your own image | ✓ Dockerfile → microVM |
| Func Persistent shared storage | — Not included | ✓ Cluster-shared volumes |
| Density Density per server | — Your engineering | ✓ 100K+ microVMs |
| Density Unit economics | — Your engineering | ✓ 10–100× better |
| Reliab Live migration | — Not included | ✓ Across hosts, live |
| Reliab Autoscale hosts | — Not included | ✓ New hosts <20 s |
| Reliab Kubernetes | — Not included | ✓ Kraftlet virtual node |
| Reliab CVE tracking & patching | — You own it | ✓ Maintained hardened fork |
| Reliab Support & compliance | — Community OSS | ✓ Engineers + SOC 2 & HIPAA |
| Func Network shield / secret injection | — Not included | ✓ Isolated shield microVM |
| Func Extend a running VM (plugins) | — Build it yourself | ✓ Authenticated plugin API |
Functionality, speed, density, reliability
Speed — under 10 ms cold start
Instant boot for any workload and instant scale-to-zero.
- Cold-start any workload in under 10 ms — and scale to zero, then statefully resume, in under 10 ms.
- The microVM guest boots in a few ms on top of the VMM. A stock Linux guest on raw Firecracker needs ~330 ms+ just to reach userspace.
“We took Go codebases from ~4 s startup with Docker on GCP to ~30 ms on Unikraft.”
— Matthew Anderson, ex-Equinix Metal
Functionality — 10 ms to fork a live VM
A full snapshot suite Firecracker doesn’t have.
- Fork a running VM (and its children) in ~10 ms - then spawn thousands of instances from a template.
- Branch live workloads, take named checkpoints, rewind a VM in place, or launch new VMs from any point, all in millisecond timescales.
- Turn any Dockerfile into your own minimal Linux microVM without rewrites, no wasm-specific changes.
- Persistent shared storage, a plugin API, and custom filesystems across the cluster.
Density & economics — 100K+ microVMs per server
Density raw Firecracker alone won’t give you.
- Run 100,000+ strongly-isolated microVMs on a single standard server.
- 10–100× better unit economics.
“We run over 100,000 strongly isolated PostgreSQL instances on a single machine.”
— Sören Schmidt, CEO, Prisma
Reliability — under 20s to add a full host
- Live-migrate running VMs across hosts for HA, maintenance, re-balancing, and spot instances.
- Autoscale a fleet of new hosts in under 20 s for spikes — and scale back to zero when idle.
- Run as a node in your existing k8s cluster (EKS/GKE/AKS) via Kraftlet — pods run as strongly-isolated microVMs.
- SOC 2 Type II and HIPAA compliant. Deploy on-prem, BYOC, or dedicated — you own the full stack, with engineers on call.
Our Firecracker isn’t the one you’d grab.
If you grab the open-source VMM you will inherit the roadmap and the CVE queue. We maintain a large fork of Firecracker, and it ships on a monthly cadence. Release 11 “Metis” of our platform, just by itself, added branching & checkpointing, custom filesystems, a plugin API, and a network shield.
Snapshotting & state — Branch a live microVM (memory + volumes) with ~ms of downtime, or take named, restorable checkpoints. Custom filesystems give agents state that follows the work across the cluster.
Networking & the shield — VPC-style multi-interface networking, plus a transparent network shield: a separate scale-to-zero microVM that filters traffic and injects secrets — so untrusted workloads never hold a secret or get unfiltered egress.
The plugin API — Transparently extend a running microVM with your own code over an authenticated channel — in-VM command execution and filesystem services, no unauthenticated service exposed. It powers the native sandbox.
Platform & operations — A rebuilt dashboard with real-time metrics and logs, automatic disk reclamation, richer health checks for drain/upgrade workflows, and always-current online enterprise docs.
Also in the platform — more you’d otherwise build: GPU support, ARM, and dynamic vertical scaling (CPU & memory on the fly).
Don’t rebuild the platform. Deploy on it.
VM-grade isolation, 10 ms cold starts, and 100K+ instances per server — on-prem, BYOC, or dedicated. No setup, no commitment.