Will Firecracker Continue to Run in Development Without Root Access?

[zicklag]

In the design doc I read:

In production environments, Firecracker should be started only via the jailer binary. The firecracker binary can also be executed directly, but this will no longer be possible in the future.

I just tried to run firecracker with jailer, but I ran into an "operation not permitted". Is that due to me missing root privileges on my machine? I'd just like it if in the future it was still possible to run firecracker without having to have root access. I love how it is able to run in userspace right now. 🙂

Also, maybe I misunderstood something and this won't be a problem at all.

[raduiliescu]

Hi @zicklag ,

Firecracker needs access to /dev/kvm and that is allowed only if a privileged user granted that permission.
Most likely the "operation not permitted" error comes because the user launching Firecracker doesn't have /dev/kvm access.
Hope this clarifies your question.

Thanks!

[zicklag]

Hi @raduiliescu the interesting thing is that Firecracker works fine without jailer.

Anyway, if it's nothing obvious, I won't worry about it too much, because my environment isn't the cleanest test environment and it's not a big deal to me now, but thanks for the reply!

[alsrdn]

@zicklag We have an issue on our ops board related to your question (#1190) . Is there a specific use-case in which you cannot use the jailer as root or do you have any concerns regarding running the jailer as root?
Although Firecracker can be run without the jailer, we don't recommend it for production environments.

[zicklag]

I just wanted to make sure that in the future I would be able to run firecracker without root, for development ( non production ) purposes.

Because the docs said that firecracker would eventually only run with jailer, and I couldn't get jailer to run without root, I just wanted to make sure that there would continue to be some way in which to run firecracker without root for development. This could be either firecracker running fine in dev without jailer, or having jailer run fine without root, as long as there will be a way to run firecracker dev without root.

I don't intend to run firecracker without jailer in production or without root, so the production case is fine for me.

[raduiliescu]

We have updated the documentation. Please see this PR - #2805

[zicklag]

Cool, thanks for the heads-up. :)