Documentation: Firecracker limitations #351
Description
With its limited feature support, there are expected functional limitations when using Kata Containers with the Firecracker hypervisor.
This issue serves as a location to track these limitations.
-
Volume Support and Host to Guest file sharing Firecracker Limitation: volume support runtime#1071
Due to lack of host to guest file sharing support in Firecracker, volumes and more importantly Kubernetes secrets and config maps do not work. This means that some Kubernetes features do not current work with Firecracker. -
Resizing of CPU and Memory resource constraints
Kata containers does not support resizing of Firecracker PODs.
Additionally as the support for Firecracker is preliminary, some features are yet to be implemented in the runtime. These include
- Unified configuration for Multi-hypervisors in kata-runtime [RFC] Support multiple isolation mechanisms using Kata runtime#1082
Kata containers today does not support choosing between multiple hypervisors using a single configuration.toml. There is a workaround possible today using a wrapper shell script to provide an alternate configuration file, which allows kata-runtime to support multiple hypervisors on the same node as shown here
https://github.com/clearlinux/cloud-native-setup/blob/master/clr-k8s-examples/setup_kata_firecracker.sh#L63 - Support for Jailer add jailer support for firecracker runtime#1129
Kata containers does not use jailer to constrain firecracker. - Support for CPU and Memory resource constraints
Kata containers does not apply the container CPU and Memory constraints for Firecracker PODs.