Where should a small team run Firecracker? Nested virtualization support and cost by cloud
· by Plori Engineering
Firecracker microVMs need KVM, so the host must be a bare-metal server or a VM on which the provider supports nested virtualization. Vultr, AWS, Google Cloud and Azure officially support nested virtualization and sell a managed Kubernetes control plane with high availability (HA). For the example setup below with one host running all month, Vultr costs the least of these four. The example costs about $179 a month on Vultr, against $300 on AWS, $313 on Google Cloud and $474 on Azure.
OVHcloud costs less, with conditions. The OVHcloud control plane in the example is not HA, and OVHcloud warns about nested virtualization during live migration. DigitalOcean costs more than Vultr in the example, and it does not state that it supports nested virtualization. One bare-metal server costs less than Vultr VMs only if more than 1.7 hosts run all month.
All prices are US dollar list prices before tax, retrieved on October 14 and 15, 2026.
Which providers let a VM run Firecracker?
Firecracker needs the KVM device. The host must be a bare-metal server, or a VM on which the provider supports nested virtualization. This is what each provider states:
| Provider | Nested virtualization, as the provider states it |
|---|---|
| Vultr | "Vultr VX1 supports nested virtualization, enabling secure provisioning of microVMs for AI sandboxes." (source) We found no official statement for Vultr's other VM plans. |
| AWS | Supported on virtual instances since February 16, 2026 (C8i, M8i, R8i), and since June 18, 2026 on more types, including M7i, M7i-flex, C7i and R7i. KVM and Hyper-V, no extra fee. (announcement, docs) |
| Google Cloud | Supported for Linux KVM. Not on E2, Arm or memory-optimized types, and not on AMD types except N4D. (docs) |
| Azure | Supported on Dv5, Dsv5, Dasv5, Dsv6, Dasv6 and Dadsv6. Not on Basv2 or Bpsv2. (docs) |
| OVHcloud Public Cloud (US) | The FAQ answers "Yes and no." KVM can start, but "as soon we will live-migrate your instance (and this can happen any time, based on our hypervisor management), then your kernel may panic." (FAQ, updated August 17, 2026) |
| DigitalOcean | No support statement. The live-migration page says: "If you have Droplets running workloads leveraging nested virtualization, you need to restart any nested VMs after a live migration." (docs) |
| Hetzner Cloud | Not supported, including dedicated-vCPU CCX plans (FAQ). Hetzner dedicated servers are only in Germany and Finland (locations). |
| Akamai/Linode | No official document found. A community answer on Linode's site says KVM is not available. This is community evidence only. |
What would a small Firecracker setup cost on each provider?
A typical small setup for a team that runs untrusted code in Firecracker microVMs could be:
- 1 or 3 Firecracker hosts in the 2 vCPU / 8 GB class, running all month
- three 2 vCPU / 4 GB Kubernetes workers and a managed Kubernetes control plane, with HA where the provider offers it
- the smallest managed PostgreSQL with at least 32 GB
- 100 GB in the standard object storage tier of each provider (on Vultr, the Standard tier costs $18 a month and includes 1 TB)
- 80 GB of block storage and 500 GB of internet egress
| Provider | HA control plane | 1 host all month | 3 hosts all month |
|---|---|---|---|
| OVHcloud Public Cloud US-West | No | $145 | $212 |
| Vultr VX1 + VKE HA | Yes ($20) | $179 | $290 |
| DigitalOcean SFO3 | Yes ($40) | $196 | $300 |
| Vultr for all other parts + 1 OVHcloud RISE-2 bare-metal server | Yes | $217 (+$80 setup) | $217 |
| AWS us-west-2 | Yes ($73) | $300 | $459 |
| Google Cloud us-west1 | Yes ($73) | $313 | $456 |
| Azure West US 2 | Yes ($73) | $474 | $619 |
The example does not include tax, support, NAT gateways, load balancers, a container registry or request fees. It also does not include public IPv4, which AWS, Google Cloud and Azure charge for separately. We did not check whether OVHcloud charges for IPv4 from October 1, 2026.
OVHcloud's smallest managed PostgreSQL (1 vCPU, 4 GB, 80 GB) costs $64. The OVHcloud and DigitalOcean hosts use shared vCPUs. For Azure, two Microsoft pages disagree. We used the stricter page: an AKS system pool needs nodes with at least 4 vCPUs, and these nodes cannot be B-series.
Why do AWS, Google Cloud and Azure cost more for a small setup?
With one host, $124 of the $179 on Vultr does not depend on the host count. This part covers the workers, control plane, PostgreSQL, object storage and block storage. The same part costs $220 on AWS, $241 on Google Cloud and $402 on Azure.
EKS, regional GKE and AKS Standard each cost $73 a month for an HA control plane. VKE HA costs $20, so the difference is $53 a month before any host runs. For AWS and Google Cloud, the control plane fee is the largest single difference.
The hosts also cost more. A Vultr VX1 with 2 vCPUs and 8 GB costs $55.48 per 730 hours and includes a 120 GB local NVMe disk. AWS m7i-flex.large costs $69.90, Google Cloud n4d-standard-2 costs $61.83 and Azure D2as_v5 costs $62.78, and each needs a separate disk.
Egress is the third difference. After the first 100 GB, AWS, Google Cloud and Azure charge $35 to $48 a month for 500 GB of object storage egress. Vultr's included transfer covers it.
With a one-year commitment, m7i-flex.large costs $46.24, n4d-standard-2 costs $38.95 and D2as_v5 costs $38.75. All three are below VX1, and we found no commitment price for VX1. With a commitment, you pay for a host whether it runs or not. It saves money only if the host runs for most of the year. The example uses on-demand list prices.
Why not move the hosts to bare metal?
OVHcloud's RISE-2 in Hillsboro has a Xeon-E 2388G with 8 cores and 16 threads, 64 GB of memory and two 512 GB NVMe disks. It costs $93 a month plus an $80 setup fee, month to month. A host-hour is one host running for one hour. A VX1 host-hour costs $0.076. One RISE-2 thus costs the same as 1,224 VX1 host-hours a month, which is 1.7 hosts that run all month.
In the example, Vultr for all other parts plus one RISE-2 costs $217 a month. With one VX1 host, Vultr alone costs $179, so the VM option costs less. With three VX1 hosts, Vultr alone costs $290, so the RISE-2 option costs less.
One server is one failure domain: if that server fails, every sandbox on it stops until the repair. Two RISE-2 servers break even only at 2,447 host-hours (3.4 hosts all month). Repair commitments are best effort, or they start after diagnosis. We found no stated repair deadline for OVHcloud Eco. phoenixNAP BMC states best effort, Latitude states 8 hours and Cherry US states 4 hours. The example also does not include the network cost between the two providers.
OVHcloud's low bare-metal prices are on a separate storefront, eco.us.ovhcloud.com (Kimsufi, So you Start, Rise), not on us.ovhcloud.com. Price and stock differ for each configuration. Vultr's Seattle bare metal with 6 cores and 32 GB costs $185 a month.
How fast are these hosts?
The scores below are single published Geekbench 6 results, one per plan. They are not our measurements.
| Plan | Single-core | Multi-core | Note |
|---|---|---|---|
| Vultr VX1 2 vCPU / 8 GB | 2,219 | 2,833 | 50 GB disk variant (result) |
| AWS m8i.large | 2,169 | 2,735 | Spare Cores |
| AWS m7i.large | 2,002 | 2,429 | Geekbench Browser |
| Azure D2as_v5 | 1,537 | 1,962 | Spare Cores |
| Google Cloud n2d-standard-2 | 1,463 | 1,812 | Spare Cores; not the n4d we priced |
We found no published score for Google Cloud n4d-standard-2, AWS m7i-flex.large, DigitalOcean s-4vcpu-8gb or OVHcloud d2-8. We do not use the score of another plan for these four. The m7i.large score does not apply to m7i-flex.large, which has a CPU baseline of 40% per vCPU.
When would the answer change?
- If your hosts run more than about 1,224 host-hours a month (1.7 hosts all month), one RISE-2 costs less than VX1 VMs. This is true only if one failure domain is acceptable.
- If a non-HA control plane and OVHcloud's live-migration warning are acceptable, OVHcloud costs less than Vultr. The example costs $145 against $179 with one host, and $212 against $290 with three hosts.
- If your hosts run for most of the year, one-year commitments bring the AWS, Google Cloud and Azure host prices below VX1. Their $73 control plane fee stays.
These numbers are for one to three 2 vCPU / 8 GB hosts in US West with a small managed stack. They do not apply if:
- your hosts must run outside the US
- you already pay for a Kubernetes control plane at AWS, Google Cloud or Azure
- you have credits or negotiated discounts
- your storage or egress is much larger than in the example