Show HN: Slim – Build and run tiny VMs from Dockerfiles • Hacker News Board

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#141

Post by logicallee » Mon, Jun 17, 2019, 6:29 AM UTC

hardwaresofton wrote: post #139

logicallee wrote: post #115

Earlier quoted context omitted.

But per the other reply, containers are a lot less "contained" than VM's? I.e. if a program wants to list its set of processes, the host could fuck up and show them some from outside its container - whereas for the same thing to happen by a VM, it would have to have code to read that outside stuff, functionality it might not even contain... so vm's seem safer than containers... is that right?

Yep, VMs are safer than containers, because there is a larger barrier between the possibly malicious code running inside the VM than there is in the container context. A container is just another process, bound by limitations via namespaces and cgroups -- running on a shared kernel as a host. But don't take my word for it: > Simply put, containers are just processes, and as such they are governed by the kernel like a…

thanks a ton for this and your other reply to me.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#142

Post by hardwaresofton » Mon, Jun 17, 2019, 8:09 AM UTC

logicallee wrote: post #140

hardwaresofton wrote: post #138

Earlier quoted context omitted.

Super late but I have an comment[0] that answers this relatively decently, particularly this sentence: > A docker container is not a VM, it is a regular process, isolated with the use of cgroups and namespaces, possibly protected (like any other process) with selinux/apparmor/etc. Where virtual machines will actually virtualize a whole machine (down to having BIOS for your imaginary motherboard and a CPU for this ima…

thanks, this was super useful. I thought all docker containers were VM's that were one level less virtualized or something, but still essentially a VM. (So, I thought that docker containers saw a virtual box with a virtual bios, fake ram size, etc etc). thanks for clearing this up for me!

No problem, it's really interesting isn't it! There's so much cool stuff out there related to this, the other side of the surge of DevOps hype that people don't see as often, there's tons of cool tech powering these newish ways of deploying software

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#143

Post by koffiezet » Thu, Jun 20, 2019, 6:55 PM UTC

mav3rick wrote: post #122

Bombthecat wrote: post #103

Earlier quoted context omitted.

You think they will, one day?

You can tighten containers but at the end of the day they are running as native processes on the same kernel. Any vulnerability and game is over. VM offers an easier (maybe heavy) mental model of security. Between guests and between guest and host.

A jail breakout, it being from a process namespace or a VM, is always a security-risk - whatever it's breaking out of. Both are sensitive to this. VM's are maybe a bit more mature and handle some stuff on hardware - but given the recent Intel oops thingies - I wouldn't rely on that too much...

"Containers are less secure" is just FUD. That VM's or containers alike are running on the same CPU is currently a much more real threat.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#144

Post by koffiezet » Thu, Jun 20, 2019, 6:57 PM UTC

dharmab wrote: post #124

Bombthecat wrote: post #103

Earlier quoted context omitted.

You think they will, one day?

Docker- probably not. Other runtimes like Kata and Firecracker? Probably.

The docker daemon itself - sure, but on OS/kernel level, they're doing exactly the same thing, where docker is probably the more scrutinized implementation out-there...