Show HN: krunvm – Create and run lightweight VMs from OCI images

• firecracker

  75 24,300 9.9 Rust

  Secure and fast microVMs for serverless computing.

  

Also, firecracker did not merge virtio-fs [1]. So I guess it is a scope and priority decision:

> To not trade off our core use case simplifying assumptions, we'll need something like a way to build different Firecracker "specialized variants" or alternatively a plugin system. This is something worth discussing for 2021. Again this is not a guarantee, but virtio-fs could fit in such a scheme, especially if it's a rust-vmm crate we can easily import over.

[1]: https://github.com/firecracker-microvm/firecracker/pull/1351...

• libkrun

  7 713 9.1 Rust

  A dynamic library providing Virtualization-based process isolation capabilities

  

krunvm uses libkrun (https://github.com/containers/libkrun) for executing the VM, and while the later is also based in rust-vmm and shares some code with Firecracker and Cloud-Hypervisor, it's specialized in the process isolation use case. This means it implements a different set of devices (most notably, virtio-fs instead of virtio-blk, and virtio-vsock+TSI (Transparent Socket Impersonation) instead of virtio-net), and it takes the form of a dynamic library instead of a final binary.

In fact, the networking limitations are caused by this use of virtio-vsock+TSI. TSI (WIP implementation here: https://github.com/containers/libkrunfw/blob/main/patches/00...) is an experimental mechanism that provides inbound and outbound networking capabilities to the guest, with zero-configuration and minimal footprint, by transparently replacing user-space AF_INET sockets with AF_TSI, that have both an AF_INET and AF_VSOCK personality.

TSI has the additional advantage that, for the host side, all connections appear to come and go to the process acting as a VMM (in this case, krunvm, as it links directly with libkrun), which makes it very container-friendly in a way that even side-cars (such as Istio) work out-of-the-box.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• krunvm

  10 1,360 5.1 Rust

  Create microVMs from OCI images

  

• libkrunfw

  1 62 5.5 C

  A dynamic library bundling the guest payload consumed by libkrun

  

It's using a different method of loading the kernel:

https://github.com/containers/libkrunfw

Firecracker is using rust-vmm:

https://github.com/rust-vmm

Suggest a related project