# `mix firecracker.install`
[🔗](https://github.com/harmont-dev/hyper/blob/main/lib/mix/tasks/firecracker.install.ex#L1)

Downloads, verifies, and installs the pinned Firecracker release (v1.16.0)
for the current CPU architecture.

    mix firecracker.install [--prefix DIR]

Steps performed:

  1. Detects the CPU architecture (`x86_64` or `aarch64`).
  2. Downloads the release tarball and verifies its SHA-256 checksum.
  3. Extracts the tarball, then copies the binaries to `<prefix>/firecracker`
     and `<prefix>/jailer` using the **bare basenames** `firecracker` and
     `jailer`. The setuid helper validates binaries via `SafeBin<"firecracker">`
     and `SafeBin<"jailer">`, which match on basename only — version-stamped
     names such as `firecracker-v1.16.0-x86_64` are rejected unconditionally.
  4. Marks both binaries executable (`0o755`).
  5. Prints the `/etc/hyper/config.toml` snippet the operator needs to paste.

This task installs **unprivileged** binaries and prints configuration.
Privilege at runtime is handled by `hyper-suidhelper` (the setuid helper).
This task does **not** setuid `firecracker` or `jailer`. Install and setuid
the helper separately with `mix suidhelper.install`.

## Options

  * `--prefix DIR` — installation directory (default: `/opt/firecracker`).

## Security requirements

After installing, ensure:

  * The binaries are root-owned and **not** group- or world-writable.
    The suidhelper refuses binaries with loose permissions.
  * `/etc/hyper/config.toml` is root-owned with mode `0644`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*