# Firecracker 78 Hacker News commenters recommended Firecracker and 20 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. It meets the Hacker Approved badge rule. **Verdict:** Open-source microVM monitor that boots KVM virtual machines in milliseconds with hard isolation for running untrusted code. Critics say it is hard to operate and lacks GPU support. ## Why people recommend it - Strong isolation, small attack surface (8 comments): "really strong sandboxing solutions, such as gvisor or firecracker, do a really good job of having very little attack surface" ([source](https://news.ycombinator.com/item?id=47726293)) "Firecracker mounts very few host systems into the VM, exposing minimal host code to malicious guests." ([source](https://news.ycombinator.com/item?id=49786658)) "launch Firecracker microvm with its own kernel, so you get hardware-level isolation" ([source](https://news.ycombinator.com/item?id=46933781)) - Millisecond boots and fast cold starts (3 comments): "firecracker is an obvious place to start because it offers best-in-class support fast cold starts and hard isolation" ([source](https://news.ycombinator.com/item?id=48413109)) "It strips down the kernel to the bare minimum, so you get VM-level isolation with millisecond boot times" ([source](https://news.ycombinator.com/item?id=46700698)) "The whole point of Firecracker over normal VM solutions is that "booting an OS" takes milliseconds." ([source](https://news.ycombinator.com/item?id=49919440)) - Good fit for sandboxing agents (5 comments): "the fact that one can run scalable sandboxes for untrusted code on Kubernetes making use of Firecracker and CoW is pretty neat" ([source](https://news.ycombinator.com/item?id=48794757)) "We recently built our own sandbox environment backed by firecracker and go. It works great." ([source](https://news.ycombinator.com/item?id=46880778)) "We wanted a cloud computer for our agent that would be as close to a metal box as possible." ([source](https://news.ycombinator.com/item?id=49634740)) - Long track record, open source (4 comments): "Amazon is actually pretty good about open sourcing core technologies like that. Firecracker is a big one." ([source](https://news.ycombinator.com/item?id=49454272)) "Firecracker has a long track record but has a lot of knobs and tunings to get the security right." ([source](https://news.ycombinator.com/item?id=49920095)) "It is basic and it works. We have not had any issues since deployed." ([source](https://news.ycombinator.com/item?id=48476035)) ## What people warn about - Hard to set up and run (5 comments): "I worked with firecracker a lot back in the day and realized it was a pain to use." ([source](https://news.ycombinator.com/item?id=47745536)) "You're likely to experience operational + setup hiccups to use it in production." ([source](https://news.ycombinator.com/item?id=47772559)) "Firecracker and gVisor don't at all feel like "libraries that install cleanly."" ([source](https://news.ycombinator.com/item?id=48194392)) - No GPU support (2 comments): "firecracker is also not super useful as afaik GPU passthrough is not ideal/working" ([source](https://news.ycombinator.com/item?id=46573740)) "Firecracker is also awkward because GPU support is pretty hard / impossible." ([source](https://news.ycombinator.com/item?id=46572682)) - Few features, limited options (3 comments): "Firecracker only allows block devices, so re-attaching an agents disk workspace requires a custom storage interface" ([source](https://news.ycombinator.com/item?id=49781555)) "it has no support for many things, eg host filesystem mounting in the guest" ([source](https://news.ycombinator.com/item?id=49803890)) "Firecracker just has a ReSTful unix socket with a defined API and launches KVM vms with limited options." ([source](https://news.ycombinator.com/item?id=48689909)) - Boots a full OS, heavy images (2 comments): "you can't just `apt install postgres` on firecracker, it needs to get baked into the image first" ([source](https://news.ycombinator.com/item?id=49247248)) "Having to boot an entire OS inside a VM is a step backwards compared to containerisation" ([source](https://news.ycombinator.com/item?id=49918871)) ## Alternatives hackers recommend - [smolvm by smolmachines](https://hackerapproved.com/p/smolvm.md): 28 recommend - [smolmachines](https://hackerapproved.com/p/smol-machines.md): 27 recommend - [libkrun](https://hackerapproved.com/p/libkrun.md): 13 recommend - [Bhatti](https://hackerapproved.com/p/bhatti.md): 8 recommend - [Local-First Linux MicroVMs for macOS](https://hackerapproved.com/p/local-first-linux-microvms-for-macos.md): 8 recommend ## Cite as Hacker Approved, "Firecracker", https://hackerapproved.com/p/firecracker/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).