mix firecracker.install (Hyper v0.1.0)

Copy Markdown View Source

Downloads, verifies, and installs the pinned Firecracker release (v1.16.0) for the current CPU architecture.

mix firecracker.install [--prefix DIR]

Steps performed:

  1. Detects the CPU architecture (x86_64 or aarch64).
  2. Downloads the release tarball and verifies its SHA-256 checksum.
  3. Extracts the tarball, then copies the binaries to <prefix>/firecracker and <prefix>/jailer using the bare basenames firecracker and jailer. The setuid helper validates binaries via SafeBin<"firecracker"> and SafeBin<"jailer">, which match on basename only — version-stamped names such as firecracker-v1.16.0-x86_64 are rejected unconditionally.
  4. Marks both binaries executable (0o755).
  5. Prints the /etc/hyper/config.toml snippet the operator needs to paste.

This task installs unprivileged binaries and prints configuration. Privilege at runtime is handled by hyper-suidhelper (the setuid helper). This task does not setuid firecracker or jailer. Install and setuid the helper separately with mix suidhelper.install.

Options

  • --prefix DIR — installation directory (default: /opt/firecracker).

Security requirements

After installing, ensure:

  • The binaries are root-owned and not group- or world-writable. The suidhelper refuses binaries with loose permissions.
  • /etc/hyper/config.toml is root-owned with mode 0644.