Fixed #5959: Reverted the use of O_NOFOLLOW for the jailer's cgroup and network namespace file operations, so symlinks are again allowed in these paths. #5958: Fixed a bug that caused vsock guest-to-host connections to time out after snapshot restore, triggered by taking a snapshot with a TX descriptor in-flight. On restore the device now replays the TX queue notification so in-flight TX descripto…
Added #5786: Added developer preview support for hotplugging and hot-unplugging PCI virtio devices (block, pmem, net) on a running microVM. The guest must manually rescan the PCI bus after hotplug and remove the device before unplug since no automatic notification mechanism is implemented yet. More information can be found in the Device Hotplugging documentation page. #5323: Add support for Vsock…
Fixed #5762: Cap virtio-rng per-request entropy to 64 KiB. Previously, a guest could construct a descriptor chain that caused Firecracker to allocate more host memory than the guest actually provided, potentially leading to excessive host memory consumption. #5818: Enforce the virtio device initialization sequence in the PCI transport, matching the existing MMIO transport behavior. The PCI transpo…
Fixed #5762: Cap virtio-rng per-request entropy to 64 KiB. Previously, a guest could construct a descriptor chain that caused Firecracker to allocate more host memory than the guest actually provided, potentially leading to excessive host memory consumption. #5818: Enforce the virtio device initialization sequence in the PCI transport, matching the existing MMIO transport behavior. The PCI transpo…
Fixed #5739: Fixed validation of TCP SYN options length when MMDS is enabled.
Added #5510, #5593, #5564: Add support for the VMClock device. The implementation supports the snapshot safety features proposed here, but doesn't provide currently any clock-specific information for helping the guest synchronize its clocks. More information can be found in docs. #5574, #5671, #5674 #5690 Added Intel Granite Rapids as a supported and tested platform for Firecracker on 6.1 host ker…
Fixed #5698: Fixed the possible ENXIO error which could occur during file open operation if the underlying file is FIFO without active readers already attached. #5705: Fixed a bug that caused Firecracker to corrupt the memory files of differential snapshots for VMs with multiple memory slots. This affected VMs using memory hot-plugging or any x86 VMs with a memory size larger than 3GiB.
Started development of v1.16
Changed #5631: Update binary copy process inside Jailer to disallow symlinks and hardlinks at the destination path and change ownership of the copied binary to the specified uid/gid.
Changed #5631: Update binary copy process inside Jailer to disallow symlinks and hardlinks at the destination path and change ownership of the copied binary to the specified uid/gid.