Comment by ignoramous | Hacker News Reader

Comment by ignoramous | Hacker News Reader

The blog post doesn't mention it but Firecracker was originally based on crosvm [0] built at Google by the ChromeOS team for a WSL-like Linux sandbox on top of ChromeOS running debian-buster containers viz. penguin (afaik) in a gentoo-based VM viz. termina [1]. crosvm inturn is part of a much bigger crostini project [2], which I find to be super fascinating, as it supports UI workloads (over Wayland and X).

If you're using ChromeOS to run any Linux app, you're using crostini which launches those apps in crosvm managed sandboxes (Container inside a VM) in seconds. In not so distant future, it looks like Android will sandbox platform workloads (running outside the Android framework?) managed by crosvm, to considerably improve security [3].

I looked for but couldn't find ChromeOS GCP instances. I mean, ChromeOS might be a great platform to run multi-tenant server workloads at this point.

[0] https://archive.is/T1ZNJ

[1] One can run custom Linux containers (other than the debian-based penguin) but not VMs (other than termina) at this point: https://chromeos.dev/en/linux/linux-on-chromeos-faq

[2] https://chromium.googlesource.com/chromiumos/docs/+/master/c...

[3] https://lwn.net/Articles/836693/

> ... launches those apps in crosvm sandboxes in seconds.

Technically true, but the initial VM launch is not all that quick. E.g., on a Pixelbook i7 launching a terminal session without the VM started, it takes about 20 seconds for the VM itself to initiate, and another 30 seconds for things like volume mounting and starting the container running Debian, for a total of 50 seconds.

Subsequent launches once the VM is started are much quicker, just a few seconds.

> I looked for but couldn't find ChromeOS GCP instances

You're looking for Container-Optimize OS: https://cloud.google.com/container-optimized-os/ , which is Chromium OS based.

It's the default OS for e.g. GKE nodes, so Google probably runs pretty large numbers of them.

Android has been increasing the amount of sanboxing around security critical projects, so this might be the next step.

https://source.android.com/security/enhancements

> ... so this might be the next step.

Absolutely.

When I first heard about KVM on Android, I thought Android was going to run every app in its own micro-VM managed by crosvm... But that'd be too resource intensive for mobile devices, I think?

What they are instead doing with this project led by Will Deacon is more towards isolating non-Android workloads that OEMs run (like Radios): https://news.ycombinator.com/item?id=10905643, https://news.ycombinator.com/item?id=24109856, https://news.ycombinator.com/item?id=14859602?

The whole Java vs Android Java vs Kotlin puts me off, and how hard it is to be productive with the NDK (vs other platforms).

However, I really like all the security efforts they put into it (which is also a reason why the NDK is so constrained).

Thanks for the links.

And for some reason Crostini still isn't available on the majority of Chromebooks.

Even on mine it keeps breaking!

Reply on news.ycombinator.com