Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Katakate – Dozens of VMs per node for safe code exec

github.com

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#21

Post by gbxk »

elric wrote: post #18
mentalgear wrote: post #3

I would really like to see a good local sandboxing solution in this space, something that is truly local-first. This is especially important since many coding models / agentic builders will eventually become lightweight enough to run them on-device instead of having to buy tokens and share user data with big LLM cloud providers.

Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.

That's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#22

Post by ATechGuy »

elric wrote: post #18
mentalgear wrote: post #3

I would really like to see a good local sandboxing solution in this space, something that is truly local-first. This is especially important since many coding models / agentic builders will eventually become lightweight enough to run them on-device instead of having to buy tokens and share user data with big LLM cloud providers.

Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.

Side-channel attacks apply to multi-tenant cloud environments, not local.

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#23

Post by [deleted] »

gbxk wrote: post #20
ed_mercer wrote: post #19

Why do I need this if I already have containers and k8s for running agents?

It is well known that containers do not provide you safe isolation. It is not their purpose. They share kernel and page cache with the host. Any kernel exploit gives to someone in a container potential root control of the host (see DirtyPipe, DirtyCow). That's why you need VM-level isolation.

[deleted]

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#24

Post by whalesalad »

From an outside perspective, this looks silly. Like fitting a square peg in a round hole. But I do ack "what if we could run vm's as easily as we run containers" use case and atm it seems like things like this (and katacontainers) are the only ways to do it. Wondering a few things: do all the layers of abstraction make things brittle and how is performance impacted?

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#25

Post by elric »

ATechGuy wrote: post #22
elric wrote: post #18

Earlier quoted context omitted.

Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.

Side-channel attacks apply to multi-tenant cloud environments, not local.

That seems like a naive take. If any of your local VMs are internet connected and are compromised, side channel attacks could be used to exfiltrate data from other VMs or the host.

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#26

Post by gbxk »

whalesalad wrote: post #24

From an outside perspective, this looks silly. Like fitting a square peg in a round hole. But I do ack "what if we could run vm's as easily as we run containers" use case and atm it seems like things like this (and katacontainers) are the only ways to do it. Wondering a few things: do all the layers of abstraction make things brittle and how is performance impacted?

It uses Kata with Firecracker which gives you as light of a boot as it gets. Subsecond booting for instance is accessible with a lighter rootfs, which is also on the roadmap (one of the easiest items, actually). The k8s layer doesn't add overhead either compared to any other VM. If you want to compare to bare containers, depending on workload, you could see a 5% overhead due to virtualization. Exact overhead would depend on workload.

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#27

Post by ATechGuy »

elric wrote: post #25
ATechGuy wrote: post #22

Earlier quoted context omitted.

Side-channel attacks apply to multi-tenant cloud environments, not local.

That seems like a naive take. If any of your local VMs are internet connected and are compromised, side channel attacks could be used to exfiltrate data from other VMs or the host.

Then why only apply to VMs, why not apps?

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#28

Post by gbxk »

Thanks everyone for the amazing feedback and discussion!

For anyone curious:

– Docs: https://docs.katakate.org

- LangChain Agent tutorial: https://docs.katakate.org/guides/langchain-agent

It's getting late where I am, so I'm heading to bed — looking forward to replying to any new comments tomorrow!

Re: Show HN: Katakate – Dozens of VMs per node for safe code exec

#30

Post by mkagenius »

mentalgear wrote: post #3

I would really like to see a good local sandboxing solution in this space, something that is truly local-first. This is especially important since many coding models / agentic builders will eventually become lightweight enough to run them on-device instead of having to buy tokens and share user data with big LLM cloud providers.

> something that is truly local-first

Hey, we built coderunner[1] exactly for this purpose. It's completely local. We use apple containers for this (which are 1:1 mapped to a lightweight VM).

1. Coderunner - https://github.com/instavm/coderunner

Post reply on HN