firecracker-containerd
firecracker-containerd enables containerd to manage containers as Firecracker microVMs, adding an isolation layer through the KVM hypervisor.
What firecracker-containerd is
firecracker-containerd enables containerd to manage containers as Firecracker microVMs, adding an isolation layer through the KVM hypervisor. The project describes sandboxing untrusted third-party containers and placing different workloads on multi-tenant hosts as potential uses. It uses container standards such as OCI image format where possible. The repository includes a control plugin and API, an out-of-process shim runtime, an agent inside the microVM, and a root filesystem image builder. Within the microVM, that agent uses runC through containerd-shim-runc-v1 to create Linux containers. Networking can use pre-created tap devices or tap devices created by CNI plugins, with examples including bridge, ptp, host-local, firewall, and tc-redirect-tap. The software is free under Apache 2.0. It requires a Linux 4.14 or later host, an Intel x86_64 processor, and KVM; the project says AMD and Arm are not supported. Build prerequisites include git, gcc, Docker CE, and Go 1.23 or later. The project describes itself as very early-stage and warns that multi-tenant use is at the user's own risk.
Good
- Free software licensed under Apache 2.0.
- Uses OCI image format where possible.
- Supports tap-device networking and listed CNI plugins.
- Includes a root filesystem image builder.
Watch out
- Requires Linux 4.14 or later, Intel x86_64, and KVM.
- AMD and Arm are not supported.
- Project is described as very early-stage.
- Multi-tenant use is at the user's own risk.
Who it suits
firecracker-containerd is for Linux operators who want containerd to run Linux containers inside Firecracker microVMs. It may suit those exploring workload isolation, provided they can meet its host requirements and evaluate the early-stage project themselves.
Verdict
firecracker-containerd connects containerd workloads to Firecracker microVMs with several networking options. Its hardware requirements, early project state, and stated multi-tenant caveat make careful evaluation important.
Plans and prices
From firecracker-containerd's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| firecracker-containerd | Free | Apache-2.0 licensed; requires Linux 4.14+, Intel x86_64, and KVM; project describes itself as in a very early state |
The facts
Each one read from firecracker-containerd's own pages, with the date it was checked.
What it does
- Build prerequisites
- The guide lists git, gcc, Docker CE, and Go 1.23 or later as prerequisites.checked 4 Oct 2026
- Components
- The repository includes a control plugin and API, an out-of-process shim runtime, an agent that runs inside the microVM, and a root filesystem image builder.checked 4 Oct 2026
- Container compatibility
- The project uses container standards such as the OCI image format where possible.checked 4 Oct 2026
- Container runtime
- The in-VM agent invokes runC through containerd's containerd-shim-runc-v1 to create Linux containers inside the microVM.checked 4 Oct 2026
- Host requirements
- The getting-started guide requires Linux 4.14 or later, an Intel x86_64 processor, and KVM; it says AMD and Arm are not yet supported by this project.checked 4 Oct 2026
- Integrations
- The getting-started guide describes CNI plugins including bridge, ptp, host-local, firewall, and tc-redirect-tap.checked 4 Oct 2026
- Isolation
- Firecracker microVMs can provide an additional layer of isolation through the KVM hypervisor.checked 4 Oct 2026
- License
- The project is licensed under Apache 2.0.checked 4 Oct 2026
- Networking
- Networking supports pre-created tap devices and tap devices created automatically by CNI plugins.checked 4 Oct 2026
- Production networking
- The guide says production deployments should choose network configuration suited to their environment and workloads, with attention to network isolation between tasks.checked 4 Oct 2026
- Project maturity
- The getting-started guide describes the project as being in a very early state and says it is not yet as plug-and-play as desired.checked 4 Oct 2026
- Purpose
- firecracker-containerd enables containerd to manage containers as Firecracker microVMs.checked 4 Oct 2026
- Security caveat
- The repository states that multi-tenant use cases are at the user's own risk.checked 4 Oct 2026
- Support
- The README directs bug reports, roadmap discussion, and feature requests to GitHub Issues, and general discussion to the Firecracker Slack #containerd channel.checked 4 Oct 2026
- Use cases
- The project describes sandboxing untrusted third-party containers and bin-packing disparate workloads on multi-tenant hosts as potential use cases.checked 4 Oct 2026
Alternatives to firecracker-containerd
- 1
Docker Desktop
Free planWebLinuxmacOSWindows7.2From $9 a month - 2
OrbStack
Free planAPImacOS7.2From $8 a month - 3
LXD
Free planWebAPILinuxSelf-hosted7.0From $25 a year - 4
Incus
Free planAPILinuxmacOSSelf-hosted6.8Free plan - 5
Apptainer
Free planAPILinuxmacOSSelf-hosted6.7Free plan - 6
Rancher Desktop
Free planAPILinuxmacOSWindows6.7Free plan