Skip to content
Added

* Added jailer option `--parent-cgroup <relative_path>` to allow the placement
  of microvm cgroups in custom cgroup nested hierarchies. The default value is
  `<exec-file>` which is backwards compatible to the behavior before this
  change.
* Added jailer option `--cgroup-version <1|2>` to support running the jailer
  on systems that have cgroup-v2. Default value is `1` which means that if
  `--cgroup-version` is not specified, the jailer will try to create cgroups
  on cgroup-v1 hierarchies only.
* Added `--http-api-max-payload-size` parameter to configure the maximum payload
  size for PUT and PATCH requests.
* Limit MMDS data store size to `--http-api-max-payload-size`.
* Cleanup all environment variables in Jailer.
* Added metrics for accesses to deprecated HTTP and command line API endpoints.
* Added permanent HTTP endpoint for `GET` on `/version` for getting the
  Firecracker version.
* Added `--metadata` parameter to enable MMDS content to be supplied from a file
  allowing the MMDS to be used when using `--no-api` to disable the API server.
* Checksum file for the release assets.
* Added support for custom headers to MMDS requests. Accepted headers are:
  `X-metadata-token`, which accepts a string value that provides a session
  token for MMDS requests; and `X-metadata-token-ttl-seconds`, which
  specifies the lifetime of the session token in seconds.
* Support and validation for host and guest kernel 5.10.
* A [kernel support policy](docs/kernel-policy.md).
* Added `io_engine` to the pre-boot block device configuration.
  Possible values: `Sync` (the default option) or `Async` (only available for
  kernels newer than 5.10.51). The `Async` variant introduces a block device
  engine that uses io_uring for executing requests asynchronously, which is in
  **developer preview** (NOT for production use).
  See `docs/api_requests/block-io-engine.md`.
* Added `block.io_engine_throttled_events` metric for measuring the number of
  virtio events throttled because of the IO engine.
* New optional `version` field to PUT requests towards `/mmds/config` to
  configure MMDS version. Accepted values are `V1` and `V2` and default is
  `V1`. MMDS `V2` is **developer preview only** (NOT for production use) and
  it does not currently work after snapshot load.
* Mandatory `network_interfaces` field to PUT requests towards
  `/mmds/config` which contains a list of network interface IDs capable of
  forwarding packets to MMDS.

Changed

* Removed the `--node` jailer parameter.
* Deprecated `vsock_id` body field in `PUT`s on `/vsock`.
* Removed the deprecated the `--seccomp-level parameter`.
* `GET` requests to MMDS require a session token to be provided through
  `X-metadata-token` header when using V2.
* Allow `PUT` requests to MMDS in order to generate a session token
  to be used for future `GET` requests when version 2 is used.
* Remove `allow_mmds_requests` field from the request body that attaches network
  interfaces. Specifying interfaces that allow forwarding requests to MMDS is done
  by adding the network interface's ID to the `network_interfaces` field of PUT
  `/mmds/config` request's body.
* Renamed `/machine-config` `ht_enabled` to `smt`.
* `smt` field is now optional on PUT `/machine-config`, defaulting to
  `false`.
* Configuring `smt: true` on aarch64 via the API is forbidden.

Fixed

* Fixed incorrect propagation of init parameters in kernel commandline.
  Related to:
  [#2709](https://github.com/firecracker-microvm/firecracker/issues/2709).
* Adapt T2 and C3 CPU templates for kernel 5.10. Firecracker was not previously
  masking some CPU features of the host or emulated by KVM, introduced in more
  recent kernels: `umip`, `vmx`, `avx512_vnni`.
* Fix jailer's cgroup implementation to accept properties that contain multiple
  dots.