Firecracker v0.15.0

Added

• New API action: SendCtrlAltDel, used to initiate a graceful shutdown,
  if the guest has driver support for i8042 and AT Keyboard. See
  the docs for details.
• New metric counting the number of egress packets with a spoofed MAC:
  net.tx_spoofed_mac_count.
• New API call: PATCH /network-interfaces/, used to update the rate limiters
  on a network interface, after the start of a microVM.

Changed

• Added missing vmm_version field to the InstanceInfo API swagger
  definition, and marked several other mandatory fields as such.
• New default command line for guest kernel:
  reboot=k panic=1 pci=off nomodules 8250.nr_uarts=0 i8042.noaux i8042.nomux i8042.nopnp i8042.dumbkbd.

Fixed

• virtio-blk: VIRTIO_BLK_T_FLUSH now working as expected.
• Vsock devices can be attached when starting Firecracker using the jailer.
• Vsock devices work properly when seccomp filtering is enabled.

Firecracker v0.14.0

Added

• Documentation for development environment setup on AWS in dev-machine-setup.md.
• Documentation for microVM networking setup in docs/network-setup.md.
• Limit the maximum supported vCPUs to 32.

Changed

• Log the app version when the Logger is initialized.
• Pretty print panic information.
• Firecracker terminates with exit code 148 when a non-whitelisted syscall is intercepted.

Fixed

• Fixed build with the vsock feature.

Firecracker v0.13.0

Added

• Documentation for Logger API Requests in docs/api_requests/logger.md.
• Documentation for Actions API Requests in docs/api_requests/actions.md.
• Documentation for MMDS in docs/mmds.md.
• Flush metrics on request via a PUT /actions with the action_type
  field set to FlushMetrics.

Changed

• Updated the swagger definition of the Logger to specify the required fields
  and provide default values for optional fields.
• Default seccomp-level is 2 (was previously 0).
• API Resource IDs can only contain alphanumeric characters and underscores.

Fixed

• Seccomp filters are now applied to all Firecracker threads.
• Enforce minimum length of 1 character for the jailer ID.
• Exit with error code when starting the jailer process fails.

Removed

• Removed InstanceHalt from the list of possible actions.

Firecracker v0.12.0

Added

• The /logger API has a new field called options. This is an array of
  strings that specify additional logging configurations. The only supported
  value is LogDirtyPages.
• When the LogDirtyPages option is configured via PUT /logger, a new metric
  called memory.dirty_pages is computed as the number of pages dirtied by the
  guest since the last time the metric was flushed.
• Log messages on both graceful and forceful termination.
• Availability of the list of dependencies for each commit inside the code base.
• Documentation on vsock experimental feature and host setup recommendations.

Changed

• PUT requests on /mmds always return 204 on success.
• PUT operations on /network-interfaces API resources no longer accept
  the previously required state parameter.
• The jailer starts with --seccomp-level=2 (was previously 0) by default.
• Log messages use anonymous-instance as instance id if none is specified.

Fixed

• Fixed crash upon instance start on hosts without 1GB huge page support.
• Fixed "fault_message" inconsistency between Open API specification and code base.
• Ensure MMDS compatibility with C5's IMDS implementation.
• Corrected the swagger specification to ensure OpenAPI 2.0 compatibility.

Firecracker v0.11.0

Added

• Apache-2.0 license
• Docs:
  • charter
  • contribution guildelines
  • design
  • getting started guide
  • security policy
  • specifications
• Experimental vhost-based vsock implementation.

Changed

• Improved MMDS network stack performance
• If the logging system is not yet initialized (via PUT /logger), log events
  are now sent to stdout/stderr.
• Moved the instance_info_fails metric under get_api_requests
• Improved readme and added links to more detailed information,
  now featured in subject-specific docs.

Fixed

• Fixed bug in the MMDS network stack, that caused some RST packets to be sent
  without a destination.
• Fixed bug in PATCH /drives, whereby the ID in the path was not checked
  against the ID in the body.

Firecracker v0.10.1

Fixed

• The Swagger definition was corrected.

Firecracker v0.10.0

Added

• Each Firecracker process has an associated microVM Metadata Store (MMDS). Its
  contents can be configured using the /mmds API resource.

Changed

• The boot source is specified only with the kernel_image_path and
  the optional parameter boot_args. All other fields are removed.
• The path_on_host property in the drive specification is now marked as
  mandatory.
• PATCH drive only allows patching/changing the path_on_host property.
• All PUT and PATCH requests return the status code 204.
• CPUID brand string (aka model name) now includes the host CPU frequency.
• API requests which add guest network interfaces have an additional parameter,
  allow_mmds_requests which defaults to false.
• Stopping the guest (e.g. using the reboot command) also terminates the
  Firecracker process. When the Firecracker process ends for any reason,
  (other than kill -9), metrics are flushed at the very end.
• On startup jailer closes all inherited file descriptors based on
  sysconf(_SC_OPEN_MAX) except input, output and error.
• The microVM ID prefixes each Firecracker log line. This ID also appears
  in the process cmdline so it's now possible to ps | grep <ID> for it.

Firecracker v0.9.0

Added

• Seccomp filtering is configured via the --seccomp-level jailer parameter.
• Firecracker logs the starting addresses of host memory areas provided as guest
  memory slots to KVM.
• The metric panic_count gets incremented to signal that a panic has occurred.
• Firecracker logs a backtrace when it crashes following a panic.
• Added basic instrumentation support for measuring boot time.

Changed

• StartInstance is a synchronous API request (it used to be an asynchronous
  request).

Fixed

• Ensure that fault messages sent by the API have valid JSON bodies.
• Use HTTP response code 500 for internal Firecracker errors, and 400 for user
  errors on InstanceStart.
• Serialize the machine configuration fields to the correct data types (as specified
  in the Swagger definition).
• NUMA node assignment is properly enforced by the jailer.
• The is_root_device and is_read_only properties are now marked as required
  in the Swagger definition of Drive object properties.

Removed

• GET requests on the /actions API resource are no longer supported.
• The metrics associated with asynchronous actions have been removed.
• Remove the action_id parameter for InstanceStart, both from the URI and the
  JSON request body.

Firecracker v0.7.0

Added

• Rate limiting functionality allows specifying an initial one time
  burst size.
• Firecracker can now boot from an arbitrary boot partition by specifying
  its unique id in the drive's API call.
• Block device rescan is triggered via a PUT /actions with the drive ID in the
  action body's payload field and the action_type field set to
  BlockDeviceRescan.

Changed

• Removed noapic from the default guest kernel command line.
• The action_id parameter is no longer required for synchronous PUT requests
  to /actions.
• PUT requests are no longer allowed on /drives resources after the guest
  has booted.

Fixed

• Fixed guest instance kernel loader to accelerate vCPUs launch and consequently
  guest kernel boot.
• Fixed network emulation to improve IO performance.

Firecracker-v0.6.0

Added

• Firecracker uses two different named pipes to record human readable logs and metrics, respectively.

Changed

• Seccomp filtering can be enabled via setting the USE_SECCOMP environment variable.
• It is possible to supply only a partial specification when attaching a rate limiter (i.e. just the bandwidth or ops parameter).
• Errors related to guest network interfaces are now more detailed.

Fixed

• Fixed a bug that was causing Firecracker to panic whenever a PUT request was sent on an existing network interface.
• The id parameter of the jailer is required to be an RFC 4122-compliant UUID.
• Fixed an issue which caused the network RX rate limiter to be more restrictive than intended.
• API requests which contain unknown fields will generate an error.
• Fixed an issue related to high CPU utilization caused by improper KVM PIT configuration.
• It is now possible to create more than one network tun/tap interface inside a jailed Firecracker.