iangudger

One of the big benefits that gVisor offers is that it doesn't require nested virtualization (or any virtualization). They released a new version that improves performance when not using virtualization a while back: https://gvisor.dev/blog/2023/04/28/systrap-release/

It could be that you happened to find a period of rapid change, but it is also possible that you ran into the issue that raggi mentioned in the sibling comment.

I don't work on gVisor anymore. That said, I think it would be a tough sell. It would be a pretty big breaking change. Also, there is already a problem with people trying to send patches against the go branch and making it the default would make that much worse.

I think the solution is an automatically exported repository at a different path. Kind of (or maybe exactly) like what Tailscale/bradfitz used to maintain.

If you want to use netstack without Bazel, just use the go branch:

https://github.com/google/gvisor/tree/go

go get gvisor.dev/gvisor/pkg/tcpip@go

The go branch is auto generated with all of the generated code checked in.

I believe this is entirely motivated by this policy: https://fuchsia.dev/fuchsia-src/contribute/governance/policy...

> That obviously doesn't work for a linux-on-fuschia compat layer.

This isn’t actually true. gVisor contains full implementations of Linux syscalls and only relies on host syscalls being the same for some interoperability features between sandboxed and host applications. It would be completely possible to port gVisor to a non-Linux operating system.

Stairwell Inc. | REMOTE USA, VISA | Full-Time

Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.

Technologies

-Backend: Go (Golang), Postgres

-Frontend: Typescript and React

-Other technologies include: Terraform, gRPC, Kubernetes

We're hiring across a variety of technical roles including: Engineering, Data Science, and Technical Account Management.

If interested in learning more or applying feel free to check us out at https://stairwell.com/careers

We strive to review and reply to candidates within a week.

Stairwell Inc. | REMOTE USA, VISA | Full-Time Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures. Technologies

-Backend: Go (Golang), Postgres

-Frontend: Typescript and React

-Other technologies include: Terraform, gRPC, Kubernetes

We're hiring across a variety of technical roles including: Engineering, Data Science, and Technical Account Management.

If interested in learning more or applying feel free to check us out at https://stairwell.com/careers

We strive to review and reply to candidates within a week.

Stairwell Inc. | REMOTE USA, VISA | Full-Time Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.

Technologies

-Backend: Go (Golang), Postgres

-Frontend: Typescript and React

-Other technologies include: Terraform, gRPC, Kubernetes

We're hiring across a variety of technical roles including: Engineering, Data Science, and Technical Account Management.

If interested in learning more or applying feel free to check us out at https://stairwell.com/careers

We strive to review and reply to candidates within a week.

Stairwell Inc. | REMOTE USA, VISA | Full-Time

Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.

Technologies

-Backend: Go (Golang), Postgres

-Frontend: Typescript and React

-Other technologies include: Terraform, gRPC, Kubernetes

We're hiring across a variety of technical roles including: Engineering, Data Science, and Technical Account Management.

If interested in learning more or applying feel free to check us out at https://stairwell.com/careers

We strive to review and reply to candidates within a week.

Note that the first reply to the HN comment you linked to points out that the poster misread the graph.

I used 20% time for things that were related to my work, but out of scope for my team. For example, I wrote a DNS library in Go for work and then I open sourced it [1] and used it to rewrite the standard library DNS client [2] as a 20% project. It actually worked out really well for me. The promo committee specifically called out my DNS project when they approved my promotion and ignored the stuff that I had been doing for my team.

[1] https://golang.org/x/net/dns/dnsmessage

[2] https://golang.org/cl/37879

Behind a paywall. View here: https://archive.is/8SvA9

I work on gVisor. gVisor supports concurrent multi-treading, but should not be vulnerable to TOCTTOU, even in ptrace mode. gVisor handles system calls itself, it does not simply verify the args for app system calls and then pass them on to the host. That said, if you find any security issues, please let us know. There is a security email address in the github issue template.

App Engine Flex is a version of App Engine that uses VMs with Linux. You can find a comparison between the standard and flexible environments here:

https://cloud.google.com/appengine/docs/the-appengine-enviro...

I work on gVisor. The answer is that having a separate kernel is required to achieve a high degree of isolation and by definition Linux containers share a kernel with the host. A separate Linux kernel could work as well, but gVisor tries to achieve a different set of trade-offs.

Java 8 is now supported with the full standard library: https://cloud.google.com/appengine/docs/standard/java/runtim...

If you want something faster than github.com/miekg/dns, there is golang.org/x/net/dns. I am the author, but I promise it is a lot faster. It is about an order of magnitude faster in my benchmarks.