firecracker-microvm/firecracker

Choose upstream unless you specifically need this exact pinned revision. This fork adds no observable features and currently lags recent upstream fixes, so it is best treated as a snapshot, not a differentiated distribution.

Prefer this fork if your priority is customized PCI/device behavior and host-specific operational tuning; prefer upstream if you need the widest device support, faster security uptake, and less divergence risk.

Choose this fork only if its benchmarking and CI workflow additions are the main value. If you need a production VMM close to current Firecracker behavior, upstream is the better default.

Choose this fork only if you specifically need the Kata snapshot-oriented downstream and can accept major divergence from upstream. If you want the full, actively maintained Firecracker VMM, upstream is the better default.

Choose this fork only if its custom testing and kernel/benchmark setup directly matches your workflow. For production or security-sensitive use, upstream is the safer default because this fork is stale and materially behind on recent fixes.

Choose this fork if your priority is host-side hardening of the jailer with Landlock and you can tolerate lagging a few upstream fixes. Choose upstream if you want the latest Firecracker behavior, broader stability updates, and maximum compatibility.

Choose this fork only if you need its ARM/timekeeping work or its expanded testing and benchmarking workflows. If you want a production base that tracks upstream Firecracker closely, this fork looks too divergent and too far behind upstream.

Choose this fork only if you specifically need the macOS/AVF direction. For production Firecracker use, upstream is the better fit because it is active, current, and much closer to the documented Linux/KVM model.

Prefer this fork only if you need its local behavior changes and are prepared to maintain a long-lived divergence. If you want a stable, broadly supported Firecracker baseline, upstream is the better choice.