Hacker News Reader

Comment by chubot | Hacker News Reader

As far as I know, Firecracker, gVisor, and Kata Containers are the solution here. They use VM primitives (x64_64 and ARM64 extensions) and have lighter codebases

https://firecracker-microvm.github.io/

https://gvisor.dev/

https://katacontainers.io/

But I don't have any direct experience with any of them. I'd be curious what people who have built on top of them think

edit: OK it looks like Kata can use Firecracker, so as far as isolation, it's either Firecracker or gVisor. And Firecracker is the VMM I mentioned, but gVisor is quite different -- it's more like a user space kernel that emulates syscalls.

View on HN

I'm going to toss in smolvm as well because firecracker needs some expertise to make the box usable and secure.

https://github.com/smol-machines/smolvm

I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata.

Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.

Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into the cluster which was alot easier actually.

Kata also breaks any potential of confidential VM unless you're a virtualization wizard.

You should go check out redhat's confidential container method for a production design overview. Their ARO self hosted system.

> gvisor isn't quite the same security level though

Which one is more secure? I thought gvisor but your sentence sounds like it implies the opposite.

For my assumed goal of yours I would say none of these are good options. A simple VM or ec2 node hosting a coding sandbox is likely the better option.

All 3 of these are vastly different tech. Confusingly, you could run all 3 of these at the same time. I know that probally doesn't help. If you want to learn more I'd go get a linux machine somewhere like aws and play around with them.

A local agent harness is a "light" sandbox in of itself you'd also be able to learn alot from.

Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option. App armor in linux is also nice gvisor like tool.

> For my assumed goal of yours

Wrong assumption, my goal was to get more information from someone who sounded knowledgeable and said "it's not quite the same security level", which was ambiguous to me.

> I know that probally doesn't help.

No, it doesn't. I know how to learn myself, I don't need someone to tell me that if I want to know more, I should go read about it.

gVisor is basically a reimplementation of the kernel interface in go using a restricted subset of known to be secure system calls against the Linux kernel.

The underlying assumption behind it is that it is easier to build a secure kernel inside of golang than in C.

I'm not your personal AI assistant go read it yourself

And I don't care about your goddamn opinion if you can't say anything interesting after "believe me guys, I know". Goodbye.

As I understand it Kata supports multiple VMM backends, Firecracker, QEmu, Cloud Hypervisor, and their own Dragonball. Except QEmu, I believe those are all built on crates in the rust-vmm ecosystem, each making slightly different tradeoffs.

Reply on news.ycombinator.com