Imagine running containers, but with actual VMs instead. That's SwarmCracker — SwarmKit tasks become Firecracker microVMs, each with its own kernel and hardware-level isolation.
| Feature | What it means for you |
|---|---|
| Per-VM kernel | Real isolation — not just namespace walls |
| SwarmKit compatible | Everything you know from Docker Swarm just works |
| Hardware virtualization | KVM gives you actual VM security |
| Fast boot | MicroVMs boot in ~100ms |
| Cross-node networking | VXLAN connects your VMs across the whole cluster |
| Rolling updates | Deploy without taking anything offline |
| Piece | What it does |
|---|---|
| Manager | Runs SwarmKit, schedules tasks, manages cluster state |
| Worker | Launches Firecracker VMs via swarmd-firecracker |
| Consul | VXLAN peer discovery across nodes |
| swarm-br0 | Local bridge for VM networking |
| VXLAN (ID 100) | Cross-node overlay on UDP 4789 |
| MicroVMs | Workloads with per-VM kernel isolation |
- Linux with KVM (
ls /dev/kvm) - root access (bridge + Firecracker setup)
The installer downloads the latest release binary and verifies its checksum —
nothing else. Node setup goes through swarmcracker setup (ADR-005 blessed path):
# 1. Install the binary (download + checksum verify)
curl -fsSL https://raw.githubusercontent.com/restuhaqza/SwarmCracker/main/install.sh | sudo bash
# 2. Verify prerequisites (KVM, kernel modules, tools)
sudo swarmcracker setup check
# 3. Install Firecracker, jailer, kernel, and rootfs
sudo swarmcracker setup install --download-kernel --download-rootfs
# 4. Create the VM bridge + enable NAT
sudo swarmcracker setup network
# 5. Generate the config
sudo swarmcracker setup config --non-interactive# On the manager node
sudo swarmcracker cluster init --advertise-addr 192.168.1.10:4242
# Get join token
sudo swarmcracker cluster token create --role worker
# On each worker
sudo swarmcracker cluster join --token SWMTKN-1-xxx 192.168.1.10:4242# Deploy nginx across the cluster
swarmcracker service create --name web --replicas 3 -p 8080:80 nginx:alpine
# Verify
swarmcracker service list
swarmcracker service ps webgit clone https://github.com/restuhaqza/swarmcracker.git
cd swarmcracker
make all📖 Full docs: swarmcracker.restuhaqza.dev
| Guide | What's inside |
|---|---|
| Getting Started | Setup walkthrough, step by step |
| Architecture | Component overview and data flow |
| CLI Reference | Every command, every flag |
| Configuration | All config keys and defaults |
| Networking | VXLAN, bridges, how VMs communicate |
| Operations | Monitoring, backup, troubleshooting |
| Security | Hardening, jailer, seccomp |
- ✅ 87% test coverage (15 packages)
- ✅ 70/70 E2E tests passing
- ✅ All 47 security/code review items addressed
- ✅ Go 1.26, 8 linters, go vet clean
- ✅ Hardened builds (PIE, stripped symbols, trimmed paths)
SwarmCracker takes security seriously. Every workload runs in a hardware-isolated Firecracker microVM with:
- KVM isolation — separate kernel per VM
- Jailer sandbox — chroot + UID/GID drop + network namespace
- Seccomp filtering — privileged syscalls blocked in guest
- Path traversal prevention — validated task IDs, secrets, mounts
- Command injection prevention — PID-file signaling, no shell interpolation
- Hardened builds — PIE binaries with stripped symbols
Read our Security Policy and Security Guide.
curl -LO https://github.com/restuhaqza/SwarmCracker/releases/download/v0.7.0/swarmcracker-v0.7.0-linux-amd64.tar.gz
tar xzf swarmcracker-v0.7.0-linux-amd64.tar.gzCheck out CONTRIBUTING.md — we'd love your help!
Apache 2.0