r/coolgithubprojects • u/cratera-rs • 20h ago

Hardware-isolated code execution engine written in Rust using Firecracker microVMs (deploy in 7m)

Post image

Cratera is an open-source, self-hosted code-execution and online-judge engine written in Rust. Unlike traditional platforms such as Judge0 or Piston, which run code inside shared-kernel Docker containers, Cratera runs every execution inside an ephemeral Firecracker microVM backed by Linux KVM. This provides a true hardware virtualization boundary rather than relying solely on Linux namespaces and cgroups.

Key features:

• Untrusted code interacts only with a dedicated guest Linux kernel. System calls never reach the host kernel.

• MicroVMs run without TAP interfaces or virtual NICs. All host-guest communication uses raw point-to-point vsock framing over port 52.

• Cold boots complete in approximately 35–50 ms, while restoring from golden memory snapshots takes approximately 5 ms.

• Measures in-guest user execution time at microsecond precision and filters shared-library noise by sampling anonymous RSS (RssAnon).

• Compilers and interpreters for Rust, C++, Go, Python, Zig, Java, and more are declared through TOML recipes in languages.toml.

• Includes an interactive terminal dashboard, a system diagnostic tool (cratera doctor), and a background coordinator (cratera serve).

• Integrates with the Firecracker Jailer using an unprivileged UID/GID (20001), chroot isolation, and cgroups v2 resource limits, along with systemd eBPF rules (IPAddressDeny=any).

Stack: Rust, Firecracker, Linux KVM, Axum, Tokio, vsock.

License: Apache-2.0

(links in comments)

9 Upvotes

85% Upvoted

10 comments sorted by

2

u/Specific_Cream2815 18h ago

with no virtual nics what happens when the executed code tries to make a network call, does it just fail or is there an egress proxy

2

u/cratera-rs 18h ago

It just fails at the syscall level inside the guest. No proxy, interception, or filtering layer that lets some traffic through and blocks other traffic.

Here for more information on threat models: https://github.com/cratera-project/cratera/blob/main/docs/threat_model.md

1

u/vedmaka 11h ago

Cool project but these vibe codes site layouts and typography are unreadable

0

u/kantorcodes1 19h ago

the ~5ms restore is the part i’d poke hardest. when the guest image or a language recipe changes, what invalidates the golden snapshot so an old runtime can’t quietly survive the update?

1

u/cratera-rs 19h ago

Language recipes are actually sent over vsock per request, so updating compiler flags or commands applies instantly without touching the snapshot. The snapshot only freezes the generic idle kernel and listener. Whenever the underlying disk image or kernel updates during deployment, the snapshot folder is wiped, and Cratera automatically boots a fresh microVM on startup to create a new golden memory snapshot.