---
title: Tip: launch Firecracker through its jailer with dropped privileges; do not run the VMM as unconstrained root | ctxsec
url: https://ctxsec.com/items/tip-run-firecracker-through-jailer-not-as-unconstrained-root
description: "PwnEscape Part 2 reached host-root code execution because the researchers started Firecracker directly as root and skipped the jailer. Production setups documented by the Firecracker project drop privileges and apply namespaces and seccomp."
status: "operational guidance (PwnEscape Part 2 via PWN.AI; Firecracker production host-setup docs)"
published: 2026-11-08
---

> PwnEscape Part 2 reached host-root code execution because the researchers started Firecracker directly as root and skipped the jailer. Production setups documented by the Firecracker project drop privileges and apply namespaces and seccomp.

[← Tips & Guides](/tips) · [markdown](/items/tip-run-firecracker-through-jailer-not-as-unconstrained-root.md)

operational guidance (PwnEscape Part 2 via PWN.AI; Firecracker production host-setup docs)

2026-11-08

### Tip: launch Firecracker through its jailer with dropped privileges; do not run the VMM as unconstrained root

- Inventory Firecracker, Kata and similar microVM hosts used for untrusted guests or AI-agent sandboxes, and confirm each VMM starts via jailer (or an equivalent supervisor) rather than a raw root process.
- Patch those hosts for [CVE-2026-99999](/items/pwnescape-cve-2026-99999) so a guest cannot obtain the memory primitive this chain starts from.
- See Firecracker's production host-setup guidance for privilege dropping, namespaces and seccomp.

Sources: [PWN.AI: PwnEscape Part 2](https://www.pwn.ai/blog/firecracker-escape) · [Firecracker production host setup](https://github.com/firecracker-microvm/firecracker/blob/main/docs/prod-host-setup.md)