Firecracker How to Securely Run Thousands of Workloads on a Single - - PowerPoint PPT Presentation

▶
firecracker
SMART_READER_LITE
LIVE PREVIEW

Firecracker How to Securely Run Thousands of Workloads on a Single - - PowerPoint PPT Presentation

Mar 25, 2023 377 likes •701 views

Firecracker How to Securely Run Thousands of Workloads on a Single Host What is Firecracker? - Open Source Project - Virtual Machine Monitor (VMM) - Runs on top of KVM - Security and isolation of VMs - Speed and density of container - Low

slide-1
SLIDE 1

Firecracker

How to Securely Run Thousands of Workloads on a Single Host

slide-2
SLIDE 2

What is Firecracker?

  • Open Source Project
  • Virtual Machine Monitor (VMM)
  • Runs on top of KVM
  • Security and isolation of VMs
  • Speed and density of container
  • Low resource overhead

2

slide-3
SLIDE 3

Why?

3

slide-4
SLIDE 4

Event driven, serverless compute service

AWS Lambda

4

Upload/Write your code

Set triggers Pay only for the used compute time

slide-5
SLIDE 5

AWS Lambda EC2 Model

5

Hardware EC2 Instance Lambda Env Customer Code Nitro Hypervisor EC2 Instance Lambda Env Customer Code EC2 Instance Lambda Env Customer Code EC2 Instance Lambda Env Customer Code EC2 Instance Lambda Env Customer Code

...

slide-6
SLIDE 6

AWS Lambda Firecracker Model

6

Hardware Lambda Env Customer Code Lambda Env Customer Code Lambda Env Customer Code Lambda Env Customer Code Lambda Env Customer Code

...

slide-7
SLIDE 7

AWS Lambda Firecracker Model (2)

7

Hardware VM Lambda Env Customer Code VM Lambda Env Customer Code VM Lambda Env Customer Code VM Lambda Env Customer Code VM Lambda Env Customer Code

...

slide-8
SLIDE 8

AWS Lambda Firecracker Model (3)

8

Hardware microVM Lambda Env Customer Code microVM Lambda Env Customer Code microVM Lambda Env Customer Code microVM Lambda Env Customer Code microVM Lambda Env Customer Code

...

Firecracker Firecracker Firecracker Firecracker Firecracker

slide-9
SLIDE 9

How?

9

slide-10
SLIDE 10

Firecracker Security Model

10

slide-11
SLIDE 11

Jailer - CGROUPS

11

  • Metering and limiting Linux mechanism
  • Cgroup - group of processes
  • Cgroup controller - enforces limits on cgroup

processes

  • 3 cgroup v1 controllers: cpu, cpuset, pids
  • Numa node for the cpuset controller
slide-12
SLIDE 12

Jailer - Seccomp

  • Whitelist Approach
  • Advanced Filtering by default:
  • Syscall number
  • Syscall arguments
  • Execution stops on non-whitelisted syscalls

12

slide-13
SLIDE 13

Other security features

  • Simple Guest Model
  • Written in Rust
  • Static linking

13

slide-14
SLIDE 14

Running Firecracker

14

slide-15
SLIDE 15

What you see, is what you get

  • Two static binaries
  • One-shot launch of a single microVM
  • rebooting a microVM =>
  • killing corresponding Firecracker
  • Launch a new Firecracker process

15

Firecracker microVM

slide-16
SLIDE 16

Firecracker User Interface

16

HTTP Server VMM JSON deserialize struct Firecracker

slide-17
SLIDE 17

VM Configuration

17

/machine-config

  • vCPU Count
  • Memory Size
  • CPU Templates
  • Topology:
  • Hyperthreading

VMM VMConfig

slide-18
SLIDE 18

I/O devices

18

  • Block devices - backed by file on

host

  • Network Interfaces - backed by TAP

device

  • Virt I/O
  • Rate Limiters

VMM VMConfig BlockDeviceConfigs NetworkInterfaceConfigs

slide-19
SLIDE 19

Boot Source

19

VMM VMConfig BlockDeviceConfigs NetworkInterfaceConfigs BootSourceConfig

/boot-source

  • Vmlinux Image (ELF for

x86_64)

  • Boot Arguments
  • No BIOS
slide-20
SLIDE 20

Starting the microVM

20

VMM VMConfig BlockDeviceConfigs NetworkInterfaceConfigs BootSourceConfig

  • Initialize memory
  • Setup the interrupt controller
  • Load the kernel
  • Setup specific architecture

registers

  • Attach legacy devices
  • Attach virtio devices
  • Create vcpus
  • Run the vcpus
slide-21
SLIDE 21

It runs, now what?

21

slide-22
SLIDE 22

Operating Firecracker at scale

22

  • Logging: Error, Warning, Info, Debug
  • Metrics
  • Flushed every 60 seconds
  • API Requests, Devices
slide-23
SLIDE 23

Resource Update after Boot

  • Block Device:
  • Path
  • Size
  • Network Device:
  • Limit network packages

23

BlockDeviceRescan

slide-24
SLIDE 24

Where are we now?

24

slide-25
SLIDE 25

Thousands of microVMs on a single host

25

  • Low memory footprint < 5 MiB
  • CPU and memory oversubscription
  • Bootime < 125 ms
  • Fine grained configuration of the VM
  • Guest Memory Size
  • Number of vCPUs
slide-26
SLIDE 26

What’s next?

26

slide-27
SLIDE 27

Enabling Container Workloads

  • Firecracker as a container runtime
  • Vsock support - ongoing progress to replace

experimental with production ready

27

slide-28
SLIDE 28

Platform Support

  • AMD Support
  • Status: Boots on AMD
  • Next: Solve boot time issue
  • ARM Support
  • Status: Boot with a root filesystem (PR in progress)
  • Next: Solve incorrect date

28

slide-29
SLIDE 29

rust-vmm

Stay tuned...

29

slide-30
SLIDE 30

Q&A

  • Lightweight VMM
  • < 125 ms boot time
  • < 5 MiB memory
  • High densities

https://github.com/firecracker-microvm

30

dpopa@amazon.com