Repolode
Enviar
losfair

losfair/bake

A Linux CLI that embeds a Firecracker microVM (binary, kernel, initrd, rootfs) into a single standalone executable that boots a container in the VM.

Ver no GitHubSite
Estrelas
483
Forks
19
Issues abertas
1
Último commit
há 9 meses

O que é?

bake packages a Firecracker microVM together with its kernel, initrd, and root filesystem into one ELF binary. Running that binary boots the microVM and starts a container entrypoint inside it, so the output behaves like a self-contained application that carries its own isolated Linux environment.

Host-guest communication runs entirely in userspace over vsock, so no root privileges are needed. The project provides outbound networking through a SOCKS5 proxy and a UDP bridge, optional WireGuard configuration, host-to-VM port publishing with -p, and directory sharing over 9p with -v. An --allow-net option restricts which IPv4 destinations the guest can reach.

The guest runs an init routine that sets up an overlay root filesystem and launches the container with runc. The ssh subcommand connects to a running instance, and a systemd subcommand prints a service unit for the binary.

Recursos principais

  • 01Embeds the Firecracker binary, kernel, initrd, and rootfs into one executable.
  • 02Runs without root privileges, with host-guest traffic carried over vsock.
  • 03Provides outbound networking via a SOCKS5 proxy and UDP bridge, with an IPv4 allowlist.
  • 04Forwards host ports into the VM with -p and shares directories over 9p with -v.
  • 05Supports WireGuard configuration and an ssh subcommand for connecting to running instances.

Casos de uso

  • Shipping a containerized application as a single binary that runs in its own microVM.
  • Running untrusted or sandboxed workloads with VM-level isolation on a Linux host.
  • Restricting an application's outbound network access with an IPv4 allowlist.

Tópicos

#firecracker#microvm#virtualization#containers#sandbox#vsock#rust#linux

Perguntas frequentes

O que é bake?
A Linux CLI that embeds a Firecracker microVM (binary, kernel, initrd, rootfs) into a single standalone executable that boots a container in the VM. bake packages a Firecracker microVM together with its kernel, initrd, and root filesystem into one ELF binary. Running that binary boots the microVM and starts a container entrypoint inside it, so the output behaves like a self-contained application that carries its own isolated Linux environment.
bake é gratuito? Qual é a licença?
bake é open source sob a licença MIT. Confira os termos da licença antes de usá-lo em produtos comerciais.
bake ainda é mantido?
Sem commits há mais de 6 meses. O último commit de bake foi em 2 de fev. de 2026.
Para que posso usar bake?
Shipping a containerized application as a single binary that runs in its own microVM. Running untrusted or sandboxed workloads with VM-level isolation on a Linux host. Restricting an application's outbound network access with an IPv4 allowlist.
Onde consigo bake?
O código-fonte e as instruções de instalação estão no GitHub: https://github.com/losfair/bake

Resumo gerado por IA a partir do README do projeto. As estatísticas do GitHub são atualizadas diariamente.

Projetos relacionados