Skip to content
Tags give the ability to mark specific points in history as being important
  • v0.22.3
    0afa0c92 · Release v0.22.3 ·
    Fixed
    
    * Fixed off-by-one error in virtio-block descriptor address validation.
  • v0.24.0
    74a5731f · Update cargo lock. ·
    Added
    
    * Added optional `resume_vm` field to `/snapshot/load` API call.
    * Added support for block rate limiter PATCH.
    * Added devtool test `-c|--cpuset-cpus` flag for cpus confinement when tests
      run.
    * Added devtool test `-m|--cpuset-mems` flag for memory confinement when tests
      run.
    * Added the virtio traditional memory ballooning device.
    * Added a mechanism to handle vCPU/VMM errors that result in process termination.
    * Added incremental guest memory snapshot support.
    * Added aarch64 snapshot support.
    
    Changed
    
    * Change the information provided in `DescribeInstance` command to provide microVM
      state information (Not started/Running/Paused) instead of whether it's started or not.
    * Removed the jailer `--extra-args` parameter. It was a noop, having been
      replaced by the `--` separator for extra arguments.
    * Changed the output of the `--version` command line parameter to include a list
      of supported snapshot data format versions for the firecracker binary.
    * Increased the maximum number of virtio devices from 11 to 19.
    * Added a new check that prevents creating v0.23 snapshots when more than 11
      devices are attached.
    * If the stdout buffer is full and non-blocking, the serial writes no longer block.
      Any new bytes will be lost, until the buffer is freed. The device also logs these
      errors and increments the `uart.error_count` metric for each lost byte.
    
    Fixed
    
    * Fixed inconsistency in YAML file InstanceInfo definition
  • v0.23.1
    775b82f5 · Release v0.23.1 ·
    Fixed inconsistency in YAML file InstanceInfo definition
  • v0.22.2
    59b8da43 · Release v0.22.2 ·
    Fixed inconsistency in YAML file InstanceInfo definition
  • v0.23.0
    Added
    
    - Added metric for throttled block device events.
    - Added metrics for counting rate limiter throttling events.
    - Added metric for counting MAC address updates.
    - Added metrics for counting TAP read and write errors.
    - Added metrics for counting RX and TX partial writes.
    - Added metrics that measure the duration of pausing and resuming the microVM,
      from the VMM perspective.
    - Added metric for measuring the duration of the last full snapshot created,
      from the VMM perspective.
    - Added metric for measuring the duration of loading a snapshot, from the VMM
      perspective.
    - Added metrics that measure the duration of pausing and resuming the microVM,
      from the API (user) perspective.
    - Added metric for measuring the duration of the last full snapshot created,
      from the API (user) perspective.
    - Added metric for measuring the duration of loading a snapshot, from the API
      (user) perspective.
    - Added `track_dirty_pages` field to `machine-config`. If enabled, Firecracker
      can create incremental guest memory snapshots by saving the dirty guest pages
      in a sparse file.
    - Added a new API call, `PATCH /vm`, for changing the microVM state (to
      `Paused` or `Resumed`).
    - Added a new API call, `PUT /snapshot/create`, for creating a full snapshot.
    - Added a new API call, `PUT /snapshot/load`, for loading a snapshot.
    - Added new jailer command line argument `--cgroup` which allow the user to
      specify the cgroups that are going to be set by the Jailer.
    - Added full support for AMD CPUs (General Availability). More details
      [here](README.md#supported-platforms).
    
    Fixed
    
    - Boot time on AMD achieves the desired performance (i.e under 150ms).
    
    Changed
    
    - The logger `level` field is now case-insensitive.
    - Disabled boot timer device after restoring a snapshot.
    - Enabled boot timer device only when specifically requested, by using the
      `--boot-timer` dedicated cmdline parameter.
    - firecracker and jailer `--version` now gets updated on each devtool
      build to the output of `git describe --dirty`, if the git repo is available.
    - MicroVM process is only attached to the cgroups defined by using `--cgroups`
      or the ones defined indirectly by using `--node`.
  • v0.22.1
    96735ee2 · Release v0.22.1. ·
    Fixed
    - Limited serial device buffer size to maximum 64 bytes.
  • v0.21.3
    b3975626 · Release v0.21.3. ·
  • v0.22.0
    cc538763 · release v0.22.0 ·
    Added
    
    - Added a new API call, `PUT /metrics`, for configuring the metrics system.
    - Added `app_name` field in InstanceInfo struct for storing the application
      name.
    - New command-line parameters for `firecracker`, named `--log-path`,
      `--level`, `--show-level` and `--show-log-origin` that can be used
      for configuring the Logger when starting the process. When using
      this method for configuration, only `--log-path` is mandatory.
    - Added a [guide](docs/devctr-image.md) for updating the dev container image.
    - Added a new API call, `PUT /mmds/config`, for configuring the
      `MMDS` with a custom valid link-local IPv4 address.
    - Added experimental JSON response format support for MMDS guest applications
      requests.
    - Added metrics for the vsock device.
    - Added devtool strip command which removes debug symbols from the release
    - Added the `tx_malformed_frames` metric for the virtio net device, emitted
      when a TX frame missing the VNET header is encountered.
    
    Fixed
    
    - Added `--version` flag to both Firecracker and Jailer.
    - Return `405 Method Not Allowed` MMDS response for non HTTP `GET` MMDS
      requests originating from guest.
    - Fixed folder permissions in the jail (#1802).
    - Any number of whitespace characters are accepted after ":" when parsing HTTP
      headers.
    - Potential panic condition caused by the net device expecting to find a VNET
      header in every frame.
    - Potential crash scenario caused by "Content-Length" HTTP header field
      accepting negative values.
    - Fixed #1754 - net: traffic blocks when running ingress UDP performance tests
      with very large buffers.
    
    Changed
    - Updated CVE-2019-3016 mitigation information in
      [Production Host Setup](docs/prod-host-setup.md)
    - In case of using an invalid JSON as a 'config-file' for Firecracker,
      the process will exit with return code 152.
    - Removed the `testrun.sh` wrapper.
    - Removed `metrics_fifo` field from the logger configuration.
    - Renamed `log_fifo` field from LoggerConfig to `log_path` and
      `metrics_fifo` field from MetricsConfig to `metrics_path`.
    - `PATCH /drives/{id}` only allowed post-boot. Use `PUT` for pre-boot
      updates to existing configurations.
    - `PATCH /network-interfaces/{id}` only allowed post-boot. Use `PUT` for
      pre-boot updates to existing configurations.
    - Changed returned status code from `500 Internal Server Error` to
      `501 Not Implemented`, for queries on the MMDS endpoint in IMDS format, when
      the requested resource value type is unsupported.
    - Allowed the MMDS data store to be initialized with all supported JSON types.
      Retrieval of these values within the guest, besides String, Array, and
      Dictionary, is only possible in JSON mode.
    - `PATCH` request on `/mmds` before the data store is initialized returns
      `403 BadRequest`.
    - Segregated MMDS documentation in MMDS design documentation and MMDS user
      guide documentation.
  • v0.21.2
    Fixed
    
    - Fixed #1754 - net: traffic blocks when running ingress UDP performance tests
      with very large buffers.
  • v0.20.1
    Fixed
    
    - Fixed #1754 - net: traffic blocks when running ingress UDP performance tests
      with very large buffers.
  • v0.21.1
    047a379e · patch release for v0.21.1 ·
    Fixed
    
    * Added --version flag to both Firecracker and Jailer
  • v0.21.0
    6fd15452 · Release v0.21.0 ·
    Added
    
    - Support for booting with an initial RAM disk image. This image can be
      specified through the new `initrd_path` field of the `/boot-source` API
      request.
    
    Fixed
    
    - Fixed #1469 - Broken GitHub location for Firecracker release binary.
    - The jailer allows changing the default api socket path by using the extra
      arguments passed to firecracker.
    - Fixed #1456 - Occasional KVM_EXIT_SHUTDOWN and bad syscall (14) during
      VM shutdown.
    - Updated the production host setup guide with steps for addressing
      CVE-2019-18960.
    - The HTTP header parsing is now case insensitive.
    - The `put_api_requests` and `patch_api_requests` metrics for net devices were
      un-swapped.
    
    Changed
    
    - Removed redundant `--seccomp-level` jailer parameter since it can be
      simply forwarded to the Firecracker executable using "end of command
      options" convention.
    - Removed `memory.dirty_pages` metric.
    - Removed `options` field from the logger configuration.
    - Decreased release binary size by ~15%.
    - Changed default API socket path to `/run/firecracker.socket`. This path
      also applies when running with the jailer.
    - Disabled KVM dirty page tracking by default.
    - Removed redundant RescanBlockDevice action from the /actions API.
      The functionality is available through the PATCH /drives API.
      See `docs/api_requests/patch-block.md`.
  • v0.20.0
    Added
    
    - Added support for GICv2.
    
    Fixed
    
    - Fixed CVE-2019-18960 - Fixed a logical error in bounds checking performed
      on vsock virtio descriptors.
    - Fixed #1283 - Can't start a VM in AARCH64 with vcpus number more than 16.
    - Fixed #1088 - The backtrace are printed on `panic`, no longer causing a
      seccomp fault.
    - Fixed #1375 - Change logger options type from Value to Vec<LogOption> to
      prevent potential unwrap on None panics.
    - Fixed #1436 - Raise interrupt for TX queue used descriptors
    - Fixed #1439 - Prevent achieving 100% cpu load when the net device rx is
      throttled by the ratelimiter
    - Fixed #1437 - Invalid fields in rate limiter related API requests are
      now failing with a proper error message.
    - Fixed #1316 - correctly determine the size of a virtio device backed
      by a block device.
    - Fixed #1383 - Log failed api requests.
    
    Changed
    
    - Decreased release binary size by 10%.
  • v0.19.1
    9b9030d9 · release v0.19.1 ·
    Fixed
    
    * Fixed a logical error in bounds checking performed on vsock virtio
      descriptors (CVE-2019-18960).
  • v0.18.1
    bf1239ea · Release v0.18.1 ·
    Fixed
    
    * Fixed a logical error in bounds checking performed on vsock virtio
      descriptors (CVE-2019-18960).
  • v0.19.0
    Added
    
    * New command-line parameter for `firecracker`, named `--no-api`, which
      will disable the API server thread. If set, the user won't be able to send
      any API requests, neither before, nor after the vm has booted. It must be
      paired with `--config-file` parameter. Also, when API server is disabled,
      MMDS is no longer available now.
    * New command-line parameter for `firecracker`, named `--config-file`, which
      represents the path to a file that contains a JSON which can be used for
      configuring and starting a microVM without sending any API requests.
    * The jailer adheres to the "end of command options" convention, meaning
      all parameters specified after `--` are forwarded verbatim to Firecracker.
    * Added `KVM_PTP` support to the recommended guest kernel config.
    * Added entry in FAQ.md for Firecracker Guest timekeeping.
    
    Changed
    
    * Vsock API call: `PUT /vsocks/{id}` changed to `PUT /vsock` and no longer
      appear to support multiple vsock devices. Any subsequent calls to this API
      endpoint will override the previous vsock device configuration.
    * Removed unused 'Halting' and 'Halted' instance states.
    
    Fixed
    
    * Fixed serial console on aarch64 (GitHub issue #1147).
    * Upon panic, the terminal is now reset to canonical mode.
    * Explicit error upon failure of vsock device creation.
    * The failure message returned by an API call is flushed in the log FIFOs.
    * Insert virtio devices in the FDT in order of their addresses sorted from
      low to high.
    * Enforce the maximum length of the network interface name to be 16 chars as
      specified in the Linux Kernel.
    * Changed the vsock property `id` to `vsock_id` so that the API client can be
      successfully generated from the swagger definition.
  • v0.18.0
    Added
    
    * New device: virtio-vsock, backed by Unix domain sockets (GitHub issue #650).
      See `docs/vsock.md`.
    
    Fixed
    
    * Updated the documentation for integration tests.
    * Fixed high CPU usage before guest network interface is brought up (GitHub
      issue #1049).
    * Fixed an issue that caused the wrong date (month) to appear in the log.
    * Fixed a bug that caused the seccomp filter to reject legit syscalls in some
      rare cases (GitHub issue #1206).
    * Docs: updated the production host setup guide.
    * Docs: updated the rootfs and kernel creation guide.
    
    Removed
    * Removed experimental support for vhost-based vsock devices.
  • v0.17.0
    Added
    
    * New API call: `PATCH /machine-config/`, used to update VM configuration,
      before the microVM boots.
    * Added an experimental swagger definition that includes the specification for
      the vsock API call.
    * Added a signal handler for `SIGBUS` and `SIGSEGV` that immediately terminates
      the process upon intercepting the signal.
    * Added documentation for signal handling utilities.
    * Added [alpha] aarch64 support.
    * Added metrics for successful read and write operations of MMDS, Net and Block devices.
    
    Changed
    
    * `vcpu_count`, `mem_size_mib` and `ht_enabled` have been changed to be mandatory
      for `PUT` requests on `/machine-config/`.
    * Disallow invalid seccomp levels by exiting with error.
    
    Fixed
    
    * Incorrect handling of bind mounts within the jailed rootfs.
    * Corrected the guide for `Alpine` guest setup.
  • v0.16.0
    Added
    
    * Added [alpha] AMD support.
    * New `devtool` command: `prepare_release`. This updates the Firecracker
      version, crate dependencies and credits in preparation for a new release.
    * New `devtool` command: `tag`. This creates a new git tag for the specified
      release number, based on the changelog contents.
    * New doc section about building with glibc.
    
    Changed
    
    * Dropped the JSON-formatted `context` command-line parameter from Firecracker
      in favor of individual classic command-line parameters.
    * When running with `jailer` the location of the API socket has changed to
      `<jail-root-path>/api.socket` (API socket was moved _inside_ the jail).
    * `PUT` and `PATCH` requests on `/mmds` with data containing any value type other
      than `String`, `Array`, `Object` will return status code 400.
    * Improved multiple error messages.
    * Removed all kernel modules from the recommended kernel config.
    
    Fixed
    
    * Corrected the seccomp filter when building with glibc.
    
    Removed
    
    * Removed the `seccomp.bad_syscalls` metric.
  • v0.15.2
    Fixed
    
    * Corrected the conditional compilation of the seccomp rule for madvise.