Hacker News Reader

Comment by mbreese | Hacker News Reader

I like this idea. It's a stripped down VM capable of only running containers. There are a couple of downsides, compared to straight docker though - you have to go through the VM layer for disk io. So, if you have a shared volume, there will be a performance hit.

However, you get a big boost for security.

This type of tech could make it possible to use (Docker) containers in a true multi-tenant system.

One question though - is it possible to specify the vmem and vcpus for the qemu VM? (Either from the command line or pod file?)

View on HN

Hi, Thanks for your interest, and congratulations, you found the original motivations behind Hyper :)

To anwer your question, yes, you can specify them. Check out the podfile documentation to know how https://docs.hyper.sh/reference/podfile.html

Yep - there it is... I missed that when I first looked.

Thanks!

As an aside - do you have a feeling for how much processing CPU power or io speed is lost when running in the hyper VM?

here you go: https://hyper.sh/faq.html (performances section)

Q: What are the performances of Hyper?

Boot: Start a hyper Pod only takes less than 350 millisecond. CPU: CPU Performance overhead is about 0.4 percent. Mem: Memory Performance overhead is about 0.64 percent.

Containers have been used in multi-tenant systems for years in both Solaris and FreeBSD via zones and jails

Not sure how secure they are. But sounds a bit scary to run my app in a shared-kernel environment.

Docker also uses a shared kernel...

edit: and why is it different than a shared hypervisor? Hypervisors have exploits, too...

Yes, but the nature of lxc makes it much easier to exploits.

And on every Docker thread someone says this. I know I've said it myself.

However, Jails and Zones aren't a security panacea either. Especially if the untrusted user has access to both the Jail and the host system.

The use case I'm thinking about is on a multi-tenant HPC cluster. There are very few non-Linux clusters like this and all of them require strict security. I'd love to deploy docker containers for data processing, but so far it's not been possible due to security concerns (unless running through a VM first).

However, I went ahead and made it explicit that I was referring to Docker containers.

Why would you give a user access to the host environment AND the jail?

There are more use-cases than just cloud web apps.

The case I mentioned was an HPC cluster. There is a ton of interest in using containers more in HPC, just for the flexibility in administration and versioning aspects. But there is a catch - you need to ensure that each user is completely isolated from the others, users can't have root access, and they can't escape from their containers. These users need to have access to both the host and the jail for practical reasons (mainly due to the way the common batch schedulers end up working and data/storage access).

Thus far, those restrictions have made it difficult to deploy Docker (or other containers) on clusters. It is possible to deploy VMs with some schedulers, but it largely hasn't caught on in many places.

Agree, and I'm a huge fan and user of both.

But separation enforced at the hardware level is a different, unambiguously better, thing.

I am a non-fan of Docker, but this elevates it to a level of strong contention. And brings Linux along for the ride.

Reply on news.ycombinator.com