Viewing profile — aliguori

Hi, I work at AWS and before that on KVM since it was a thing. Restricting /dev/kvm these days doesn't make much sense. The interface is designed to be safe for any user. The fact …

Kata Containers is a lot of infrastructure for running containers and it uses QEMU to run the actual VMs. Firecracker just replaces the QEMU part and we're eager to work with folks…

Yes, the root volume on i3.metal is exposed as NVMe and is EBS-backed.

Sorry for that. The timeout behavior on earlier kernels is a bit of a pain. There's a lot to love about NVMe and timeouts are not actually part of the NVMe specification itself but…

Yes, all customer PV instances in EC2 are running in an HVM container and are protected against the guest-to-guest Meltdown vulnerability. As with all virtual and physical machines…

We're still working the details out upstream but the TL;DR is that the way to address Meltdown with Xen PV is to use nested virtualization so that the outer guest is an HVM or PVH …

C5 does not support nested virtualization but i3.metal allows using virtualization technology without nested virtualization. Both i3.metal and c5 use the same underlying Nitro tech…

I tried to cover this in my re:Invent session and walked through how we have been evolving the Nitro System over the last 5 years. Videos and slides will be posted eventually.

Thanks! Would love to hear more about the counters that your interested in. We've exposed more in C5 than in previous instance types and we are trying to make more available over t…

It's exactly the same as with the i3.16xlarge instance type. There are eight 1900 GB drives. In an i3.16xlarge, those eight drives are passed through to the instance with PCIe pass…

There is more coming at re:Invent. We have more talks queued up tomorrow on this too.

You can provision these servers just like any other instance. They work just like any other Amazon EC2 instance (same Nitro System platform as C5). Disclaimer: I work at AWS on the…

> Hopefully Amazon will disclose more details. We will have some more details on how this all works at re:Invent in a couple weeks.

You claim it's objectively bad then only cite subjective things like function, structure, and variable names. That word doesn't mean what you think it means :-)

Technically that was breaking out of QEMU. It was not KVM specific. If you break into QEMU, you should be a non-privileged user. If you are using libvirt, you are in a cgroup based…

IBM uses a test called IPAT for hiring. It's more of an IQ test than personality.

Maybe if you work down town but a lot of tech companies are in north Austin where housing is very cheap.

These are all good points and I agree for the most part. However, I have found that a lot of the benefits of virtualization are often lost because of the flexibility of having a fu…

Michael Hines has done a fantastic job getting this series merged. It's a rather invasive change and I am amazed at how quickly it was merged.

I don't think you understand the problem. The problem is that the PRNG has a weak default entropy source. The same problem existed in the kernel for ages. See http://www.factorable…

This analysis of steal time is not entirely correct. Steal time exists to fix a problem. When a hypervisor needs to pre-empt a running guest, without steal time, when the hyperviso…

> Workload Manager (WLM) [1] has been a part of IBM z/OS since before it was even called z/OS. WLM implemented something like cgroups scheduling, in that existing utilization sampl…

Hi David, > Mature containers have been around since the the days of mainframes. Citation needed. I'd go as far as to say that there is no such thing as a mature container technolo…

This is not about privacy, it's about self incrimination which is far, far more important. You can be compelled to testify under oath for many reasons none of which involve doing a…