Hacker News Reader

Comment by regularfry | Hacker News Reader

From memory, I seem to recall that Genode takes this to its logical conclusion: every process is isolated with virtualization primitives.

As to why: isolating processes the old way needs jails to work properly, BSD lost the popularity contest, and Linux jails didn't get secure enough before VMs and containers took off.

View on HN

Did the BSD jails provide enough isolation? Would memory from a process truly be isolated from another? How about FD’s?

Could there be side channel attacks? At what level?

Perhaps the whole kernel design needs to be revisited, which I assume is what’s being taken on by Fuchsia.

I’ve seen no evidence that Fuchsia is bringing much more than 90s era embedded OS design. Just because it’s not Linux doesn’t mean it’s new.

Not that this is a bad thing, but someone please correct me if there is something fundamentally recent in Zircon.

The BSD jails / Solaris zones approach is not the same at the path taken by Linux. Linux gives you a facility to isolate network, a facility to isolate process views etc. You put them all together and you get a "container". The former starts off by having a container primitive that can't do much because, well, it's contained from everything. You then proceed to give it access to the network, the filesystem.

What do you mean? Isolating network and isolate processes view is what FreeBSD jail was always doing. The most common use of freebsd jails was providing VPS servers to users.

No argument there. My point is that the default for FreeBSD jails is "isolate everything" and it's up to the user to open it up.

My post was in response to 'sayhello' that is wondering whether jails provide enough isolation.

I see, I misunderstood what you meant.

Reply on news.ycombinator.com