Learn Firecracker - Pre-Requisites Skill & Setup Environment

#Introduction

Welcome to the Learn Firecracker series! This series will take you through mastering Firecracker — the lightweight Rust-based Virtual Machine Monitor (VMM) that powers AWS Lambda and Fargate, as well as the technology behind many modern serverless and PaaS platforms. There are 23 episodes in total, arranged into six phases, from microVM concepts all the way to container runtime integration and production readiness.

Firecracker is not an ordinary VM. It is designed for a single purpose: running thousands of tiny VMs with super-fast boot and minimal resource overhead — a fundamentally different pattern from the QEMU you've been used to. Because its philosophy is different, the way you use it is different too: one process per VM, managed through an API on a Unix socket, isolated with the jailer.

This Episode 0 is your roadmap. We'll make sure the foundational skills are in place, prepare a host with KVM enabled, download the Firecracker binaries, prepare the microVM kernel and rootfs, and verify the environment for the first time. Once this episode is done, the remaining 22 episodes can be followed comfortably.

#Foundational Skills You Must Have

#Linux Administration and KVM

Firecracker is a VMM that depends entirely on KVM (Kernel-based Virtual Machine). That means you should be comfortable managing a Linux host: process management, permissions, namespaces, cgroups, and making sure hardware virtualization is enabled in the BIOS. KVM is not emulation — VMs run directly as kernel processes, and Firecracker leverages that so boot takes only milliseconds.

#CLI, Bash, and Container Concepts

Firecracker is managed through the command line and an HTTP API over a Unix socket. You'll write a lot of curl, ip, jailer, and firecracker. A good understanding of containers (Docker/containerd) helps a lot because Firecracker's workload pattern — images, filesystems, registries — resembles containers, only with deeper isolation at the hardware level.

#Basic Networking

MicroVMs need networking. You'll create TAP interfaces on the host, connect them to a bridge, and configure IP addresses inside the guest. Understand the basics of TAP, bridge, and virtio — these are the key to episodes 5 and 13 later on.

#Cloud and Serverless

A good grasp of PaaS/serverless platforms like Lambda helps you understand why Firecracker exists. Concepts like cold start, scale-to-zero, and multi-tenant isolation will keep coming up throughout the series.

#Software and Hardware to Prepare

#An x86_64/aarch64 Host with KVM

Firecracker supports x86_64 and aarch64 (Intel/AMD/Arm) and requires hardware virtualization. First check whether your host is ready:

Check KVM on the host

lscpu | grep -i virtualization
ls -l /dev/kvm
lsmod | grep kvm

/dev/kvm must exist, and lsmod | grep kvm must show kvm together with kvm_intel or kvm_amd. If both commands come back empty, enable virtualization in the BIOS/UEFI or use a cloud instance with nested virtualization. Firecracker cannot run without KVM — it is not a pure emulator like an unaccelerated QEMU.

For a more convenient check, install cpu-checker, which provides kvm-ok:

sudo apt install -y cpu-checker
sudo kvm-ok

The output KVM acceleration can be used is your first green light. If the host doesn't have /dev/kvm, don't move on to the next episode until this is resolved — every practice in this series depends on it.

#The firecracker and jailer Binaries

Download the official release from GitHub. In this series we use v1.16.x (the current stable version; v1.16.1 was released on July 2, 2026):

ARCH="x86_64" # or aarch64
wget "https://github.com/firecracker-microvm/firecracker/releases/download/v1.16.1/firecracker-v1.16.1-${ARCH}.tgz"
tar -xzf "firecracker-v1.16.1-${ARCH}.tgz"
sudo cp "release-v1.16.1-${ARCH}/firecracker-v1.16.1" /usr/local/bin/firecracker
sudo cp "release-v1.16.1-${ARCH}/jailer-v1.16.1" /usr/local/bin/jailer

Note: the release archive contains two important binaries — firecracker (the VMM itself) and jailer (security isolation). Both will be your companions throughout the series. Verify:

firecracker --version
jailer --version

#Kernel and MicroVM Rootfs

A microVM needs two files: a kernel (vmlinux or linux.bin) and a rootfs. Firecracker doesn't boot via traditional BIOS/UEFI; it loads the kernel directly into memory and starts from the entry point — that's one of the secrets of its speed. For episode 0, download a common, readily available kernel (for example, from the kernel repository provided by the Firecracker community) and create a minimal ext4 rootfs:

mkdir -p ~/fc-demo && cd ~/fc-demo
wget https://s3.amazonaws.com/spec.ccfc.min/img/quickstart_guide/x86_64/kernels/vmlinux.bin
dd if=/dev/zero of=rootfs.ext4 bs=1M count=512
mkfs.ext4 rootfs.ext4
mkdir -p /tmp/rootfs && sudo mount rootfs.ext4 /tmp/rootfs

Fill the rootfs with a minimal distro (for example, Alpine via apk in a chroot, or copy a ready-made rootfs). We dig deep into proper image building in episode 8 — in this episode 0, it's enough to make sure the vmlinux.bin and rootfs.ext4 files exist. Unmount when you're done.

#curl and Docker (Optional)

curl is required because the entire Firecracker API is accessed through curl --unix-socket. Docker is optional — it's useful in episode 11 for building container images that will run inside the microVM:

curl --version
docker --version # optional

#Verifying the Environment

Before moving on, run a thorough verification:

uname -a
ls -l /dev/kvm
sudo kvm-ok
firecracker --version
jailer --version
curl --version

All commands must succeed without errors. Also make sure the host uses cgroup v2 (Firecracker leverages it for resource isolation together with the jailer):

stat -fc %T /sys/fs/cgroup/

Output cgroup2fs means cgroup v2 is active.

#Prerequisite Summary

Here's what you've set up in episode 0:

• Skills: Linux administration, KVM, CLI/bash, container concepts, basic networking, and a grasp of cloud/serverless.
• Host: x86_64/aarch64 with /dev/kvm active, cgroup v2.
• Tooling: firecracker and jailer v1.16.x, curl, kvm-ok.
• Images: vmlinux.bin (kernel) and rootfs.ext4 (minimal filesystem).
• Optional: Docker for the container integration episode later.

If anything is missing, stop and complete it first. All subsequent episodes assume they run on top of this prepared environment.

#Closing

The key takeaways:

• Firecracker requires KVM — without /dev/kvm, there are no microVMs.
• Two main binaries: firecracker (the VMM) and jailer (security isolation).
• MicroVMs boot from a directly loaded kernel, not from firmware — the basis of their speed.
• cgroup v2 and curl are the operational foundation you'll keep using.
• Verify the environment with kvm-ok, firecracker --version, and jailer --version.

In the next episode 1 we'll cover the history, background, and why Firecracker is needed — from its roots in the Chromium OS crosvm project, to the reasons AWS rewrote it in Rust, all the way to the 15 trillion Lambda invocations per month that run on Firecracker. Make sure your host is ready, because the Learn Firecracker journey is just beginning!