Workshop · In release validation
fc-ctl is a self-hosted runtime for asynchronous jobs in isolated Firecracker microVMs. Approved OCI images run without Kubernetes and with clear limits for runtime, resources, networking and output.
How can SaaS products run bounded background jobs on their own infrastructure without giving them access to the application host or other workloads, and without operating a full cluster platform?
01
Public serverless services do not always meet data sovereignty and regulatory requirements. Containers share their host kernel, full cluster platforms are often excessive for bounded jobs, and commercial alternatives introduce licence costs or vendor dependency.
02
A Controller durably stores jobs, Workers and results in SQLite; Workers pull work themselves and require no inbound connections. Approved OCI images are distributed through S3 as immutable root filesystem artefacts and cached locally. By default, every job cold-starts in a short-lived Firecracker microVM with its own Jailer identity, controlled networking and communication through vsock. Signed requests, attempt-specific leases, secrets injected only at runtime, and resource and output limits protect the lifecycle. Warm pools and snapshots remain optional.
03
The Controller, Worker, CLI, PHP SDK, image pipeline, security hardening, recovery, metrics and runbooks are implemented. Real Linux tests with Firecracker cover both guest profiles, resource and network limits, S3 failures, reboots, backup and restore. Following corrections made during those runs, one clean end-to-end qualification of the unchanged release candidate remains. Optional private networking with WireGuard and CoreDNS still requires its separate two-Worker gate.
04
The unchanged candidate will be qualified once more in a fresh Linux environment. Monitoring and backups will then be approved, followed where needed by the two-Worker gate. An MCP interface is also planned, allowing agents to configure, start, monitor and manage complete workloads in isolated Firecracker microVMs. The first use remains a controlled internal pilot as the runtime for s3s.sh.
