Imagine running containers, but with actual VMs instead. That's SwarmCracker — SwarmKit tasks become Firecracker microVMs, each with its own kernel and hardware-level isolation.
| Feature | What it means for you |
|---|---|
| Per-VM kernel | Real isolation — not just namespace walls |
| SwarmKit compatible | Everything you know from Docker Swarm just works |
| Hardware virtualization | KVM gives you actual VM security |
| Fast boot | MicroVMs boot in ~100ms |
| Cross-node networking | VXLAN connects your VMs across the whole cluster |
| Rolling updates | Deploy without taking anything offline |
| Piece | What it does |
|---|---|
| Manager | Runs SwarmKit, schedules tasks, manages cluster state |
| Worker | Launches Firecracker VMs via swarmd-firecracker |
| Consul | VXLAN peer discovery across nodes |
| swarm-br0 | Local bridge for VM networking |
| VXLAN (ID 100) | Cross-node overlay on UDP 4789 |
| MicroVMs | Workloads with per-VM kernel isolation |
- Linux with KVM (
ls /dev/kvm) - Firecracker v1.15+ (install script handles this)
- Go 1.26+ (build from source only)
curl -fsSL https://raw.githubusercontent.com/restuhaqza/SwarmCracker/main/install.sh | bash# On the manager node
sudo swarmcracker cluster init --advertise-addr 192.168.1.10:4242
# Get join token
sudo swarmcracker cluster token create --role worker
# On each worker
sudo swarmcracker cluster join --token SWMTKN-1-xxx 192.168.1.10:4242# Deploy nginx across the cluster
swarmcracker service create --name web --replicas 3 -p 8080:80 nginx:alpine
# Verify
swarmcracker service list
swarmcracker service ps webgit clone https://github.com/restuhaqza/swarmcracker.git
cd swarmcracker
make all📖 Full docs: swarmcracker.restuhaqza.dev
| Guide | What's inside |
|---|---|
| Getting Started | Setup walkthrough, step by step |
| Architecture | Component overview and data flow |
| CLI Reference | Every command, every flag |
| Configuration | All config keys and defaults |
| Networking | VXLAN, bridges, how VMs communicate |
| Operations | Monitoring, backup, troubleshooting |
| Security | Hardening, jailer, seccomp |
- ✅ 87% test coverage (15 packages)
- ✅ 70/70 E2E tests passing
- ✅ All 47 security/code review items addressed
- ✅ Go 1.26, 8 linters, go vet clean
- ✅ Hardened builds (PIE, stripped symbols, trimmed paths)
SwarmCracker takes security seriously. Every workload runs in a hardware-isolated Firecracker microVM with:
- KVM isolation — separate kernel per VM
- Jailer sandbox — chroot + UID/GID drop + network namespace
- Seccomp filtering — privileged syscalls blocked in guest
- Path traversal prevention — validated task IDs, secrets, mounts
- Command injection prevention — PID-file signaling, no shell interpolation
- Hardened builds — PIE binaries with stripped symbols
Read our Security Policy and Security Guide.
curl -LO https://github.com/restuhaqza/SwarmCracker/releases/download/v0.7.0/swarmcracker-v0.7.0-linux-amd64.tar.gz
tar xzf swarmcracker-v0.7.0-linux-amd64.tar.gzCheck out CONTRIBUTING.md — we'd love your help!
Apache 2.0