<div id="readability-page-1" class="page"><div><p>If you want to run untrusted code like code generated by LLMs you will quickly realize that you need a way to sandbox the code. You could of course run the code in a container, but that is generally not considered secure enough. You could also run the code in a traditional virtual machine, but that is probably overkill and too resource intensive for short-lived tasks. This is where Firecracker and QEMU come in.</p>
<p>Both Firecracker and QEMU are virtualization solutions that can be used to run untrusted code. They are both KVM-based and offer robust isolation, but they serve distinctly different needs and come with their own sets of tradeoffs.</p>
<p>Firecracker, developed by AWS, has gained significant attention for being lightweight, fast, and security-focused. It powers AWS Lambda's serverless infrastructure, handling tens of trillion function invocations monthly [16]. Its minimal footprint and rapid boot times make it particularly attractive for ephemeral workloads.</p>
<p>On the other hand, QEMU has established itself as the Swiss Army knife of virtualization. With its rich feature set and extensive hardware support, it powers everything from development environments to production servers. While it may not match Firecracker's lightning-fast boot times, QEMU offers unparalleled flexibility, supporting full system emulation, hardware acceleration, and a wide range of (sometimes legacy) virtual devices that modern development workflows depend on.</p>
<p>This comparison will go into both virtualization solutions, exploring their architectures, strengths, and limitations. So let's go and sandbox some untrusted code!</p>
<h2 id="virtualization-basics">Virtualization Basics</h2>
<p>Virtualization lets you run multiple isolated operating systems on a single physical machine. Modern CPUs include special instructions that make virtualization faster and more secure. If you're a bit rusty on the basics, here are the key components:</p>
<p><strong>Virtual Machine (VM</strong>) is an isolated environment that acts like a complete computer, with its own CPU, memory, storage, and network resources. VMs run their own operating systems and can't directly interfere with each other.</p>
<p><strong>Virtual Machine Monitor (VMM</strong>) or <strong>Hypervisor</strong> is the software layer that creates and manages VMs. It controls how VMs access the physical hardware and ensures they remain isolated from each other. VMMs come in two types:</p>
<ul>
<li>Type 1 hypervisors run directly on hardware (like VMware ESXi)</li>
<li>Type 2 hypervisors run on top of an operating system (like VirtualBox)</li>
</ul>
<p><strong>KVM (Kernel-based Virtual Machine</strong>) is Linux's built-in hypervisor. When enabled, it turns the Linux kernel into a Type 1 hypervisor, letting you run VMs with near-native performance. Both QEMU and Firecracker use KVM for CPU virtualization.</p>
<figure></figure>
<h2 id="qemu">QEMU</h2>
<p>QEMU stands for Quick EMUlator. It's widely used in production environments to run virtual machines for web servers, databases, and development environments. It can run as a pure emulator to mimic different CPU architectures, or as a virtualizer using KVM for near-native performance [<a href="#sources">0</a>].</p>
<p>QEMU handles common VM workloads like running Linux servers, Windows instances, and containerized applications. Developers use it to test software across different operating systems, run CI/CD pipelines, and deploy production services. It's particularly useful when you need to run multiple isolated environments on a single machine. When running with KVM, QEMU delegates CPU and memory management to the Linux kernel while handling I/O and device emulation itself. This split design lets QEMU support a wide range of devices while maintaining good performance for basic compute tasks.</p>
<h3 id="what-makes-qemu-special">What makes QEMU special?</h3>
<ul>
<li><strong>Extensive Platform Support</strong>: You can run almost anything on QEMU. From ancient s390x [<a href="#sources">17</a>] systems to modern full-desktop environments, if you need it, QEMU probably supports it [<a href="#sources">5</a>]</li>
<li><strong>Full Emulation and KVM Acceleration</strong>: Support for both emulation and hardware-accelerated KVM virtualization. [<a href="#sources">0</a>]</li>
<li><strong>Ecosystem and Integration</strong>: QEMU's long history means there's a vast array of tools and integrations available.</li>
<li><strong>MicroVM Mode</strong>: QEMU MicroVMs [<a href="#sources">13</a>], more similar to Firecracker. Less devices supported, faster boot times (4x as fast as normal QEMU, still 3x slower than Firecracker)</li>
</ul>
<h3 id="what-are-the-tradeoffs">What are the tradeoffs?</h3>
<p>With age and versatility comes a different set of tradeoffs:</p>
<ul>
<li><strong>Complexity and Security</strong>: With nearly 2 million lines of C code [<a href="#sources">6</a>], QEMU's attack surface is significantly larger, with a history of CVEs. [<a href="#sources">7</a>]</li>
<li><strong>Performance</strong>: QEMU's full-featured nature means slower boot times and higher memory usage, which can be a bottleneck for ephemeral or lightweight workloads. [<a href="#sources">8</a>][<a href="#sources">14</a>]</li>
<li><strong>Developer Experience</strong>: The vast options (the manpage is over 47 pages long [<a href="#sources">11</a>]) can be overwhelming, leading to a steeper learning curve.</li>
</ul>
<h2 id="firecracker">Firecracker</h2>
<p>Firecracker is a virtual machine monitor (VMM) built by AWS specifically for running serverless workloads. It's a stripped-down virtualization tool that focuses on speed and security rather than flexibility. Using KVM under the hood, Firecracker creates lightweight virtual machines called microVMs [<a href="#sources">1</a>].</p>
<p>Unlike traditional VMs that might take several seconds to start, Firecracker VMs can boot up in as little as 125ms. AWS built it to power Lambda and Fargate [<a href="#sources">2</a>], where they need to quickly spin up isolated environments for running customer code. Companies like <a href="https://e2b.dev/" target="_blank" rel="noopener noreferrer" data-external="true">E2B</a> use Firecracker to run AI generated code securily in the cloud, while Fly.io uses it to run lightweight container-like VMs at the edge [<a href="#sources">4</a>, <a href="#sources">5</a>].</p>
<p>Firecracker runs as a single process on your host machine and exposes a simple API for creating and managing VMs. Each microVM is minimal - it only includes the devices and functionality needed to run a basic Linux kernel. This minimalist approach helps keep the codebase small and reduces potential security vulnerabilities.</p>
<h3 id="what-makes-firecracker-special">What makes Firecracker special?</h3>
<ul>
<li><strong>Small and Secure</strong>: Written in Rust with only 50k lines of code (as of 2020), significantly reducing the attack surface and overall complexity [<a href="#sources">12</a>]</li>
<li><strong>Fast Boots</strong>: Starts VMs 3x faster than QEMU MicroVMs and 10x faster than normal QEMU emulation [<a href="#sources">8</a>]</li>
<li><strong>Minimal Memory Usage</strong>: Each microVM has less than 5MB RAM overhead [<a href="#sources">9</a>]</li>
<li><strong>Simple Architecture</strong>: Single process with a straightforward API, making it easy to manage and integrate [<a href="#sources">12</a>]</li>
<li><strong>Resource Efficient</strong>: Designed for overcommitting hardware resources, perfect for serverless workloads</li>
</ul>
<h3 id="what-are-the-tradeoffs-1">What are the tradeoffs?</h3>
<ul>
<li><strong>Limited Device Support</strong>: Minimal device emulation - no support for legacy hardware like floppy disks</li>
<li><strong>No GPU Support</strong>: Currently lacks PCIe support, making GPU passthrough impossible (work has been stopped for 2025) [<a href="#sources">10</a>]</li>
<li><strong>Smaller Ecosystem</strong>: While growing with adopters like E2B and Fly.io, the ecosystem is still smaller than QEMU's [<a href="#sources">3</a>, <a href="#sources">4</a>]</li>
</ul>
<h2 id="so-what">So what?</h2>
<p>Of course, the decision is very nuanced and specific to your use case. In general:</p>
<ul>
<li>Choose Firecracker if you're looking for speed, security, and efficiency for serverless computing or edge computing scenarios with modern hardware support.</li>
<li>Choose QEMU if you need versatility, support for a broader range of hardware, full system emulation, or if you're dealing with legacy systems or development environments requiring extensive device emulation.</li>
</ul>
<figure></figure>
<h2 id="sources">Sources</h2>
<ol>
<li><a href="https://www.qemu.org/" target="_blank" rel="noopener noreferrer" data-external="true">QEMU</a></li>
<li><a href="https://firecracker-microvm.github.io/" target="_blank" rel="noopener noreferrer" data-external="true">Firecracker</a></li>
<li><a href="https://www.usenix.org/system/files/nsdi20-paper-agache.pdf" target="_blank" rel="noopener noreferrer" data-external="true">Firecracker Paper</a></li>
<li><a href="https://github.com/e2b-dev/runtime" target="_blank" rel="noopener noreferrer" data-external="true">E2B</a></li>
<li><a href="https://fly.io/docs/reference/architecture/" target="_blank" rel="noopener noreferrer" data-external="true">Fly.io</a></li>
<li><a href="https://www.qemu.org/docs/master/about/build-platforms.html" target="_blank" rel="noopener noreferrer" data-external="true">QEMU Build Platforms</a></li>
<li><a href="https://openhub.net/p/qemu" target="_blank" rel="noopener noreferrer" data-external="true">QEMU OpenHub</a></li>
<li><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-7506/Qemu.html" target="_blank" rel="noopener noreferrer" data-external="true">QEMU CVEs</a></li>
<li><a href="https://doi.org/10.1145/3447786.3456248" target="_blank" rel="noopener noreferrer" data-external="true">Firecracker Boot Time</a></li>
<li><a href="https://firecracker-microvm.github.io/#:~:text=This%2C%20along%20with%20a%20streamlined,a%20%3C%205%20MiB%20memory%20footprint." target="_blank" rel="noopener noreferrer" data-external="true">Firecracker Memory Footprint</a></li>
<li><a href="https://github.com/firecracker-microvm/firecracker/issues/4845" target="_blank" rel="noopener noreferrer" data-external="true">Firecracker PCIe</a></li>
<li><a href="https://manpages.debian.org/jessie/qemu-system-x86/qemu-system-x86_64.1.en.html" target="_blank" rel="noopener noreferrer" data-external="true">QEMU manpage</a></li>
<li><a href="https://github.com/firecracker-microvm/firecracker" target="_blank" rel="noopener noreferrer" data-external="true">Firecracker Github</a></li>
<li><a href="https://www.qemu.org/docs/master/system/i386/microvm.html" target="_blank" rel="noopener noreferrer" data-external="true">QEMU MicroVMs</a></li>
<li><a href="https://dreadl0ck.net/papers/Firebench.pdf" target="_blank" rel="noopener noreferrer" data-external="true">Performance analysis of KVM-based microVMs orchestrated by Firecracker and QEMU</a></li>
<li><a href="https://github.com/firecracker-microvm/firecracker/blob/main/CREDITS.md" target="_blank" rel="noopener noreferrer" data-external="true">Firecracker Credits</a></li>
<li><a href="https://aws.amazon.com/blogs/aws/aws-lambda-turns-ten-the-first-decade-of-serverless-innovation/" target="_blank" rel="noopener noreferrer" data-external="true">AWS Lambda</a></li>
<li><a href="https://aws.amazon.com/blogs/aws/aws-lambda-turns-ten-the-first-decade-of-serverless-innovation/" target="_blank" rel="noopener noreferrer" data-external="true">‍</a><a href="https://www.qemu.org/docs/master/system/target-s390x.html" target="_blank" rel="noopener noreferrer" data-external="true">S390x</a></li>
</ol>
<h2 id="additional-reading">Additional Reading</h2>
</div></div>

E2B Blog & Customer Stories

Vaclav Mlejnsky

Firecracker vs QEMU for sandboxing untrusted, LLM-generated code: how the two virtualization technologies compare on boot time, footprint, isolation, and more.

Firecracker vs QEMU

댓글