Compare · kosa8 vs Firecracker

kosa8 vs raw Firecracker

Q: Does Firecracker support GPUs?

Not in any release; the VFIO tracking issue is open. kosa8 sandboxes have no GPU today either.

Checked 2026-11-14

Firecracker is an Apache-2.0 virtual machine monitor that uses KVM to run microVMs, and it powers AWS Lambda and Fargate [1] [2]. It gives you a VM over a REST API; networking, filtering, snapshot handling, clone safety and logging are yours to build [3] [4] [5]. kosa8 is a finished sandbox product: microVMs with a host-enforced allow-list, an egress broker for keys, approvals, an audit log, checkpoint, rewind and fork.

Start free See the table

01The short verdict

Choose Firecracker if

you are building your own sandbox platform and have engineers to own it [1];
you want the VMM behind Lambda and Fargate, with boot under 125 ms and under 5 MiB of overhead per VM [1];
you need full control of every layer and no vendor or licence cost [1];
your hosts are Linux with KVM, and you do not need macOS or Windows [7].

Choose kosa8 if

you want sandboxes this week, not a platform project;
you need them on Apple silicon Macs and Windows (WSL2) as well as Linux [14];
you want safe fork, rewind, egress allow-lists and keys outside the VM already built [15] [17];
you need an audit log and approvals your security team can check [20].

02Firecracker and kosa8, feature by feature

Feature	Firecracker	kosa8
Isolation	KVM microVMs, with a jailer for chroot, namespaces, cgroups and a privilege drop [1] [6]	A microVM per sandbox with its own Linux kernel: Apple's Virtualization framework on a Mac, Cloud Hypervisor on KVM on x86-64 Linux; kosa8 Cloud runs the same sandboxes on kosa8's hosts [13]
Self-host and air-gap	Yes: you run it on your own Linux hosts; air-gapped use not documented [1] [7]	Yes: your computer, your own KVM Linux servers, or an air-gapped site with a signed offline licence (Enterprise, quoted) [14]
Bring your own cloud (BYOC)	Not applicable: you operate the hosts	Your own KVM Linux servers join your Cloud organization through an outbound tunnel, $0.20 per host-hour, no compute charge [14]
Regions	Linux on x86_64 and aarch64 with `/dev/kvm`; on EC2, metal instances [7]	kosa8 Cloud: US (Dallas, Texas) and EU (Helsinki). Locally: wherever your machines are [15]
Fork a running VM	Build it yourself: restoring one snapshot into many VMs duplicates IDs and random state, and clones share network config [4] [8]	Yes: live copies with memory and processes intact (`kosa8 fork`; on Cloud up to 100 per call). Plans count how many copies run at once [15] [16]
Snapshots and rewind	Full snapshots of state and memory; diff snapshots in developer preview; files are yours to manage and secure [4]	Checkpoint and rewind of memory, processes and disk; a sleeping Cloud sandbox keeps a snapshot at $0.08 per GB-month [15] [16]
Egress allow-list	Build it yourself: tap devices and host firewall rules; Firecracker does no traffic filtering [3] [5]	Host-enforced allow-list (names, `*.domain`, IPs, CIDRs) fixed at create, with API keys added by an egress broker outside the VM. kosa8 Cloud has no egress policy setting yet [17] [18]
Kill switch or freeze	`PATCH /vm` to Paused; an external watchdog is advised [4] [5]	`kosa8 sandbox pause --all` stops every sandbox's CPUs in place; on Cloud an organization freeze refuses new work, sleeps every sandbox and can suspend keys [18] [19]
Audit trail	A logger and JSON metrics; an audit trail is not documented [9]	Signed, hash-chained log anyone can check with `kosa8 audit verify`; Cloud streams it to Splunk, Datadog or a webhook [18] [20]
SSO	Not applicable	kosa8 Cloud: OIDC with Okta, Entra ID or Google Workspace, and it can be required. No SAML or SCIM yet [18] [20]
GPU	No: not in any release; the VFIO issue is open [10] [11]	No. Sandboxes have no GPU today [21]
SDK languages	REST API over a Unix socket, specified in OpenAPI; the Go SDK is archived [2] [12]	Python, JavaScript and TypeScript, Go, Ruby, Java; plus an HTTP API, a CLI and an MCP server [15]
Pricing model	Free, Apache-2.0; you pay for your KVM hosts [1]	Plans from $29 a month for your own machines, each with Cloud credit; Cloud per second at $0.048 per vCPU-hour and $0.0154 per GB-hour [16]
Free tier	Free	Free on your computer after email sign-up (sandboxes, save and undo, dashboard); $30 of Cloud credit once a card is added [16]
Security audit status	Not applicable: software you run	SOC 2 in progress (no report yet); no external penetration test yet [22]

Bracketed numbers point to the sources. "Not documented" means the vendor's own pages did not say on 2026-11-14; it does not mean the feature is missing.

03Where Firecracker is stronger

Scale and maturity. Firecracker runs AWS Lambda and Fargate in production [1] [2].
Footprint. Under 125 ms boot and under 5 MiB of overhead per VM [1].
Ecosystem. Used by containerd, Kata Containers and many sandbox vendors [1].
No licence. Apache-2.0, with every layer under your control [1].

04Where kosa8 is different

The parts around the VM. Host-enforced allow-lists, an egress broker for keys, approvals and a hash-chained log come built in [17] [20] [22].
Clone safety handled. kosa8 forks a running sandbox into live copies as one command [15]; Firecracker's docs list the ID, randomness and network issues you must handle yourself [8].
Beyond Linux hosts. kosa8 uses Apple's Virtualization framework on a Mac and Cloud Hypervisor on KVM on Linux [13].
A hosted option. The same sandboxes on kosa8 Cloud through one API [15].

05Moving from Firecracker to kosa8

Firecracker's getting-started guide boots a VM with three API calls over its socket, after you fetch a kernel and root filesystem and set up networking yourself [7] [3].

Firecracker, from its getting-started guide:

terminal

sudo curl -X PUT --unix-socket "${API_SOCKET}" \
    --data "{
        \"kernel_image_path\": \"${KERNEL}\",
        \"boot_args\": \"${KERNEL_BOOT_ARGS}\"
    }" \
    "http://localhost/boot-source"

sudo curl -X PUT --unix-socket "${API_SOCKET}" \
    --data "{
        \"drive_id\": \"rootfs\",
        \"path_on_host\": \"${ROOTFS}\",
        \"is_root_device\": true,
        \"is_read_only\": false
    }" \
    "http://localhost/drives/rootfs"

sudo curl -X PUT --unix-socket "${API_SOCKET}" \
    --data "{
        \"action_type\": \"InstanceStart\"
    }" \
    "http://localhost/actions"

The same idea in kosa8, with the network closed except one host:

terminal

kosa8 sandbox create agent --egress-allow api.anthropic.com
kosa8 checkpoint agent --label "before the risky step"
kosa8 fork agent -n 3 --prefix trial
kosa8 rewind agent

kosa8 picks the kernel and guest image; you pull OCI images into the sandbox with kosa8 sandbox pull [19].
Tap devices and iptables become --egress-allow, enforced on the host before boot [17].
PUT /snapshot/create and /snapshot/load become kosa8 checkpoint and kosa8 rewind [15].
kosa8 on Linux runs on Cloud Hypervisor, not Firecracker; both use KVM [13].

06Questions

Is Firecracker a sandbox?

It is a virtual machine monitor: it runs microVMs on KVM over a REST API [1] [2]. Networking, filtering, logging and clone handling are left to you [3] [5] [8].

Can I clone a running Firecracker VM safely?

Its docs warn that restoring one snapshot into several VMs duplicates IDs, random seeds and network configuration, and describe the extra work [4] [8]. kosa8's fork does this as one command [15].

Does Firecracker support GPUs?

Not in any release; the VFIO tracking issue is open [10] [11]. kosa8 sandboxes have no GPU today either [21].

Does kosa8 use Firecracker?

No. kosa8 uses Apple's Virtualization framework on a Mac and Cloud Hypervisor on KVM on Linux [13].

07Sources, checked on 2026-11-14

Every fact about another product comes from that vendor's own documentation or pricing page, read on 2026-11-14. Where its pages do not say, the table says "not documented" rather than guess. Products change quickly: check the current pages before you decide, and tell us if something here is out of date.