--- title: How Firecracker microVMs work under the hood to sandbox... description: Firecracker microVMs combine the fast startup and low overhead of containers with the strong isolation of full virtual machines, making them ideal for... canonical: https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Firecracker microVMs work under the hood to sandbox untrusted code and AI agents | daily.dev og:description: Firecracker microVMs combine the fast startup and low overhead of containers with the strong isolation of full virtual machines, making them ideal for... og:url: https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr og:image: https://api.daily.dev/og/posts/8JBiGINnR.png og:image:alt: How Firecracker microVMs work under the hood to sandbox untrusted code and AI agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Firecracker microVMs work under the hood to sandbox untrusted code and AI agents **[Sylvain Kerkour](https://daily.dev/sources/kerkour)** · 8 min read · 1 upvotes · 0 comments ## Summary Firecracker microVMs combine the fast startup and low overhead of containers with the strong isolation of full virtual machines, making them ideal for sandboxing untrusted code and AI agents. The post explains Firecracker's two-component architecture — the jailer (privilege-dropping sandbox) and the VMM (Virtual Machine Monitor interfacing with Linux KVM) — and walks through internals including its event-based type-safe state machine in Rust, snapshot format using serde/bincode, and HTTP socket-based control API. MicroVMs start in ~100ms and use under 15MB per instance. The post also highlights cloud-hypervisor, an Intel-backed rust-vmm sibling that adds GPU and shared folder support, as often the more practical choice for real workloads. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Firecracker achieve fast VM startup times compared to traditional virtual machines? Firecracker microVMs boot in about 100 milliseconds and use under 15 megabytes of memory per VM by running a trimmed-down kernel that only includes virtio drivers, which are optimized to interface with virtual devices exposed by the hypervisor, instead of emulating full hardware like traditional VMs do. _Engineers weighing microVMs against containers for isolation can dig deeper into sandboxing trade-offs on daily.dev._ ### What are the two main components of the Firecracker architecture? Firecracker consists of the jailer and the Virtual Machine Monitor (VMM). The jailer sandboxes and restricts the privileges of the VMM process to limit the impact of any vulnerability, while the VMM is the actual program that interfaces with the Linux KVM hypervisor and exposes an HTTP API over a Unix socket for sending commands like starting an instance. _Developers designing secure multi-tenant systems can track architecture deep dives like this on daily.dev._ ### What is the difference between Firecracker and cloud-hypervisor for running microVMs? Cloud-hypervisor, built by Intel on the same rust-vmm foundation as Firecracker, supports GPU passthrough and shared folders between host and guest VM, features Firecracker lacks, making cloud-hypervisor the better choice when those capabilities are needed for microVM workloads. _Teams choosing a microVM hypervisor for their stack can compare options like this on daily.dev._ ## Similar posts on daily.dev - [Your Container Is Not a Sandbox](https://daily.dev/posts/your-container-is-not-a-sandbox-dkskd3kl8) · Lobsters · 26 upvotes · 1 comments - [Why MicroVMs: The Architecture Behind Docker Sandboxes](https://daily.dev/posts/why-microvms-the-architecture-behind-docker-sandboxes-qzo1tfme1) · Docker · 10 upvotes · 0 comments - [We rebuilt the Linux microVM stack on Apple Silicon](https://daily.dev/posts/we-rebuilt-the-linux-microvm-stack-on-apple-silicon-2hmxgetth) · Encore · 21 upvotes · 2 comments - [Run isolated sandboxes with full lifecycle control: AWS Lambda introduces MicroVMs](https://daily.dev/posts/run-isolated-sandboxes-with-full-lifecycle-control-aws-lambda-introduces-microvms-ynja57lql) · AWS · 0 upvotes · 0 comments --- Tags: [#infrastructure](https://daily.dev/tags/infrastructure), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Firecracker microVMs work under the hood to sandbox untrusted code and AI agents","url":"https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr"},"datePublished":"2026-08-11T08:55:30.137Z","dateModified":"2026-09-13T21:45:55.651Z","description":"Firecracker microVMs combine the fast startup and low overhead of containers with the strong isolation of full virtual machines, making them ideal for...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Sylvain Kerkour","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sylvain Kerkour","logo":"https://media.daily.dev/image/upload/s--3ngWt4Yp--/f_auto,q_auto/v1786438308/logos/kerkour?_a=BAMAMicg0","url":"https://daily.dev/sources/kerkour"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"infrastructure,rust","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sylvain Kerkour","item":"https://daily.dev/sources/kerkour"},{"@type":"ListItem","position":3,"name":"How Firecracker microVMs work under the hood to sandbox untrusted code and AI agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-firecracker-microvms-work-under-the-hood-to-sandbox-untrusted-code-and-ai-agents-8jbiginnr#faq","mainEntity":[{"@type":"Question","name":"How does Firecracker achieve fast VM startup times compared to traditional virtual machines?","acceptedAnswer":{"@type":"Answer","text":"Firecracker microVMs boot in about 100 milliseconds and use under 15 megabytes of memory per VM by running a trimmed-down kernel that only includes virtio drivers, which are optimized to interface with virtual devices exposed by the hypervisor, instead of emulating full hardware like traditional VMs do. Engineers weighing microVMs against containers for isolation can dig deeper into sandboxing trade-offs on daily.dev."}},{"@type":"Question","name":"What are the two main components of the Firecracker architecture?","acceptedAnswer":{"@type":"Answer","text":"Firecracker consists of the jailer and the Virtual Machine Monitor (VMM). The jailer sandboxes and restricts the privileges of the VMM process to limit the impact of any vulnerability, while the VMM is the actual program that interfaces with the Linux KVM hypervisor and exposes an HTTP API over a Unix socket for sending commands like starting an instance. Developers designing secure multi-tenant systems can track architecture deep dives like this on daily.dev."}},{"@type":"Question","name":"What is the difference between Firecracker and cloud-hypervisor for running microVMs?","acceptedAnswer":{"@type":"Answer","text":"Cloud-hypervisor, built by Intel on the same rust-vmm foundation as Firecracker, supports GPU passthrough and shared folders between host and guest VM, features Firecracker lacks, making cloud-hypervisor the better choice when those capabilities are needed for microVM workloads. Teams choosing a microVM hypervisor for their stack can compare options like this on daily.dev."}}]} ```