{"id":13509607,"url":"https://github.com/firecracker-microvm/firecracker-containerd","last_synced_at":"2025-05-14T19:08:38.467Z","repository":{"id":37319098,"uuid":"157781317","full_name":"firecracker-microvm/firecracker-containerd","owner":"firecracker-microvm","description":"firecracker-containerd enables containerd to manage containers as Firecracker microVMs","archived":false,"fork":false,"pushed_at":"2025-04-17T18:49:49.000Z","size":3039,"stargazers_count":2331,"open_issues_count":93,"forks_count":199,"subscribers_count":49,"default_branch":"main","last_synced_at":"2025-04-18T08:50:00.508Z","etag":null,"topics":["aws","containerd","containers","firecracker","firecracker-containerd","firecracker-microvms","oci","virtualization"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/firecracker-microvm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-11-15T22:36:30.000Z","updated_at":"2025-04-17T18:48:14.000Z","dependencies_parsed_at":"2024-01-13T09:36:44.183Z","dependency_job_id":"a557114e-45c7-47b4-99b6-914c5b1adeb4","html_url":"https://github.com/firecracker-microvm/firecracker-containerd","commit_stats":{"total_commits":779,"total_committers":48,"mean_commits":"16.229166666666668","dds":0.6777920410783056,"last_synced_commit":"81c6e227cc0b1e831fb6dccae4bfeeb32b71c970"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/firecracker-microvm%2Ffirecracker-containerd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/firecracker-microvm%2Ffirecracker-containerd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/firecracker-microvm%2Ffirecracker-containerd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/firecracker-microvm%2Ffirecracker-containerd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/firecracker-microvm","download_url":"https://codeload.github.com/firecracker-microvm/firecracker-containerd/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254209859,"owners_count":22032897,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","containerd","containers","firecracker","firecracker-containerd","firecracker-microvms","oci","virtualization"],"created_at":"2024-08-01T02:01:10.265Z","updated_at":"2025-05-14T19:08:37.952Z","avatar_url":"https://github.com/firecracker-microvm.png","language":"Go","funding_links":[],"categories":["Go","Uncategorized","Tools","aws","工具","Projects","Runtimes \u0026 Platforms"],"sub_categories":["Uncategorized","Container Runtime","容器运行时","Security"],"readme":"# firecracker-containerd\n\n[![BuildKite](https://badge.buildkite.com/aab4ae547d5e5079a5915522e8cdb18492349aef67aae5a8c5.svg?branch=main)](https://buildkite.com/firecracker-microvm/firecracker-containerd)\n[![GitHub Actions](https://github.com/firecracker-microvm/firecracker-containerd/actions/workflows/build.yaml/badge.svg)](https://github.com/firecracker-microvm/firecracker-containerd/actions)\n\nThis repository enables the use of a container runtime,\n[containerd](https://containerd.io), to manage\n[Firecracker](https://github.com/firecracker-microvm/firecracker) microVMs.\nLike traditional containers, Firecracker microVMs offer fast start-up and\nshut-down and minimal overhead.  Unlike traditional containers, however, they\ncan provide an additional layer of isolation via the KVM hypervisor.\n\nPotential use cases of Firecracker-based containers include:\n\n* Sandbox a partially or fully untrusted third party container\n  in its own microVM.  This would reduce the likelihood of\n  leaking secrets via the third party container, for example.\n* Bin-pack disparate container workloads on the same host,\n  while maintaining a high level of isolation between containers.  Because\n  the overhead of Firecracker is low, the achievable container\n  density per host should be comparable to\n  running containers using kernel-based container runtimes,\n  without the isolation compromise of such solutions.  Multi-tenant\n  hosts would particularly benefit from this use case.\n\nTo maintain compatibility with the container ecosystem, where possible, we use\ncontainer standards such as the OCI image format.\n\nThere are several components in this repository that enable containerd to use\nFirecracker microVMs to run containers:\n\n* A [control plugin](firecracker-control) managing the lifecycle of the\n  runtime and implementing our [control API](proto/firecracker.proto) to\n  manage the lifecycle of microVMs. The control plugin is compiled in to the\n  containerd binary since [building a Go plugin out-of-tree is hard](https://github.com/golang/go/issues/20481),\n  which requires us to build a specialized containerd binary for\n  firecracker-containerd.\n* A [runtime](runtime) linking containerd (outside the microVM) to the\n  Firecracker virtual machine monitor (VMM).  The runtime is implemented as an\n  out-of-process\n  [shim runtime](https://github.com/containerd/containerd/issues/2426)\n  communicating over ttrpc.\n* An [agent](agent) running inside the microVM, which invokes\n  [runC](https://runc.io) via containerd's `containerd-shim-runc-v1`\n  to create standard Linux containers inside the microVM.\n* A [root file filesystem image builder](tools/image-builder) that\n  constructs a firecracker microVM root filesystem containing runc and\n  the firecracker-containerd agent.\n\nFor more detailed information on the components and how they work, see\n[architecture.md](docs/architecture.md).\n\n## Roadmap\n\nTo support the widest variety of workloads, firecracker-containerd has to work\nwith popular container orchestration frameworks such as Kubernetes and Amazon\nECS, so we will work to ensure that the software is conformant or compatible\nwhere necessary.  The project currently allows you to launch a few containers\ncolocated in the same microVM, and we are exploring how to raise the number of\ncontainers.  We recently added support for configuring networking at the microVM\nlevel with CNI plugins and provide a CNI plugin suitable for chaining called\n\"tc-redirect-tap\".  Our short term roadmap includes constraining or \"jailing\"\nthe Firecracker VMM process to improve the host security posture.  Our\nlonger-term roadmap includes polishing, packaging, and generally making\nfirecracker-containerd easier to run as well as exploring CRI conformance and\ncompatibility with Kubernetes.\n\nDetails of specific roadmap items are tracked in [GitHub\nissues](https://github.com/firecracker-microvm/firecracker-containerd/issues).\n\n## Usage\n\nFor detailed instructions on building and running\nfirecracker-containerd, see the\n[getting started guide](docs/getting-started.md) and the\n[quickstart guide](docs/quickstart.md).\n\n## Questions?\n\nPlease use [GitHub\nissues](https://github.com/firecracker-microvm/firecracker-containerd/issues) to\nreport problems, discuss roadmap items, or make feature requests.\n\nIf you've discovered an issue that may have security implications to\nusers or developers of this software, please do not report it using\nGitHub issues, but instead follow\n[Firecracker's security reporting\nguidelines](https://github.com/firecracker-microvm/firecracker/blob/main/SECURITY-POLICY.md).\n\nOther discussion: For general discussion, please join us in the `#containerd`\nchannel on the [Firecracker Slack](https://join.slack.com/t/firecracker-microvm/shared_invite/zt-oxbm7tqt-GLlze9zZ7sdRSDY6OnXXHg).\n\n## License\n\nThis library is licensed under the Apache 2.0 License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffirecracker-microvm%2Ffirecracker-containerd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffirecracker-microvm%2Ffirecracker-containerd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffirecracker-microvm%2Ffirecracker-containerd/lists"}