MicroVMs combine the strong isolation of virtual machines with startup times and memory overhead close to containers. They power serverless platforms and code sandboxes where thousands of untrusted workloads start and stop every minute. This guide explains Firecracker, Cloud Hypervisor and Kata Containers.
Before you start
- Understand containers vs virtual machines.
- Running microVMs yourself requires KVM access on the host (bare metal or nested virtualization).
What makes a VM "micro"
- Minimal device model: only a few VirtIO devices (network, block, vsock), no BIOS, USB, graphics or legacy hardware.
- Small, fast kernel: a stripped-down Linux kernel boots directly.
- Tiny footprint: a few MB of memory overhead per VM and boot times measured in milliseconds.
- Smaller attack surface: less emulated hardware means fewer places for escape bugs.
Firecracker
Firecracker is an open-source virtual machine monitor written in Rust, originally built for AWS Lambda and Fargate. It uses KVM, exposes a REST API on a Unix socket to configure each microVM, and is usually run inside a jailer that adds cgroups, namespaces and seccomp around it.
Cloud Hypervisor
Cloud Hypervisor is another Rust VMM focused on modern cloud workloads. It supports more features than Firecracker, such as CPU and memory hotplug, VFIO passthrough and Windows guests, while staying lean.
Kata Containers
Kata Containers lets you keep using container images and tools (containerd, Kubernetes) while each pod runs inside its own lightweight VM. It can use QEMU, Firecracker or Cloud Hypervisor underneath. This gives VM-level isolation to multi-tenant Kubernetes clusters without changing images.
MicroVMs vs containers vs VMs
| Containers | MicroVMs | Full VMs | |
|---|---|---|---|
| Isolation | Shared kernel | Own kernel, minimal devices | Own kernel, full devices |
| Boot time | Milliseconds | Around a hundred milliseconds or less | Seconds |
| OS support | Linux on Linux | Mostly Linux | Any OS |
| Best for | Your own apps | Untrusted code, serverless, sandboxes | Long-running servers, VPS |
When to use microVMs
- Running customer-submitted code (CI runners, notebooks, AI agent sandboxes).
- Function-as-a-service platforms needing fast cold starts.
- Hardening multi-tenant Kubernetes with Kata.
- Not necessary for a single team's web apps; regular containers inside a VPS are simpler.
Frequently asked questions
Can I run Firecracker on a VPS?
Only if the VPS exposes KVM through nested virtualization.
Does Firecracker support Windows?
No, it targets Linux guests. Cloud Hypervisor can run Windows.
Are microVMs replacing Docker?
No. They are often used underneath container tooling to add isolation, not instead of it.