Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Smol machines – subsecond coldstart, portable virtual machines

github.com

Post reply on HN
Print view View original

61–70 of 162 posts

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#61

Post by binsquare »

lambdanodecore wrote: post #31
binsquare wrote: post #28

Earlier quoted context omitted.

I can support docker - will ship a compatible kernel with the necessary flags in the next release.

I tried something like this already, also including nested kvm. I think this will increase the boot time quiet a bit. Also libkrun is not secure by default. From their README.md: > The libkrun security model is primarily defined by the consideration that both the guest and the VMM pertain to the same security context. For many operations, the VMM acts as a proxy for the guest within the host. Host resources that are…

Security is a broad topic.

Here's how my perspective:

smolvm operates on the same shared responsibility model as other virtual machines.

VM provides VM-level isolation.

If the user mounts a directory with the capability of symlinks or a host OS with a path for guest software that is designed to escape - that is the responsibility of the user rather than the VM.

Security is not guaranteed by using a specific piece of software, it's a process that requires different pieces for different situations. smolvm can be a part of that process.

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#62

Post by simonreiff »

Hey this is pretty neat! I definitely would try using this for benchmarks and other places where I need strong isolation as Docker is just too bloated and slow, but sadly I don't think I can run this natively on my Windows laptop. I hope you extend to WSL! Good luck and congrats on launch.

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#63

Post by fqiao »

lambdanodecore wrote: post #31
binsquare wrote: post #28

Earlier quoted context omitted.

I can support docker - will ship a compatible kernel with the necessary flags in the next release.

I tried something like this already, also including nested kvm. I think this will increase the boot time quiet a bit. Also libkrun is not secure by default. From their README.md: > The libkrun security model is primarily defined by the consideration that both the guest and the VMM pertain to the same security context. For many operations, the VMM acts as a proxy for the guest within the host. Host resources that are…

Thanks so much for the feedbacks. Yes these are valid concerns around libkrun security, We are planning and developing features around them actually, and hopefully that could alleviate the conerns.

for virtio-fs, yes the risk of exposing the host fs struture exists, and we plan to:

1. creating staging directory for each vm and bind-mount the host dir onto them

2. having private mount namespaces for vms

they are both tracked in our github issues:

https://github.com/smol-machines/smolvm/issues/152 https://github.com/smol-machines/smolvm/issues/151

2 may need much more efforts than we imagine, but we will ensure to call this out in our doc.

For the concern around TSI, we are developing virtio-net in-parallel, it is also tracked in our github and will be released soon: https://github.com/smol-machines/smolvm/issues/91

Would like to collect mroe suggestions on how to make this safer. Thanks!

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#64

Post by binsquare »

lacoolj wrote: post #59
binsquare wrote: post #2

Hello, I'm building a replacement for docker containers with a virtual machine with the ergonomics of containers + subsecond start times. I worked in AWS previously in the container space + with firecracker. I realized the container is an unnecessary layer that slowed things down + firecracker was a technology designed for AWS org structure + usecase. So I ended up building a hybrid taking the best of containers with…

What percentage of this code was written by LLM/AI?

For myself, I'd estimate ~50%

Not useful for things it hadn't been trained on before. But now I have the core functionality in place - it's been of great help.

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#65

Post by fqiao »

simonreiff wrote: post #62

Hey this is pretty neat! I definitely would try using this for benchmarks and other places where I need strong isolation as Docker is just too bloated and slow, but sadly I don't think I can run this natively on my Windows laptop. I hope you extend to WSL! Good luck and congrats on launch.

Hey thanks so much for the feedback. Yah try it and let us know. We have a discord if you want to join, but either github or discord feel free to report any issues you find to us.

Cheers!

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#67

Post by fqiao »

leetrout wrote: post #13
fqiao wrote: post #3

Give it a try folks. Would really love to hear all the feedbacks! Cheers!

why did you seemingly create two HN accounts? Edit: I see this appears to be a contributor to the project as well. It was not obvious to me.

No worry at all! Thanks!

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#68

Post by binsquare »

nonameiguess wrote: post #41

What are you actually doing on top of libkrun? Providing really small machine images that boot quickly? If I run the smolvm run --image alpine example, what is "alpine?" Where is that image coming from? Does this have some built-in default registry of machine images it pulls from? Does it need an Internet connection that allows outbound access to wherever this registry runs? Is it one of a default set of pre-built im…

i run a custom fork of libkrun, libkrunfw (linux kernel), etc etc: https://github.com/orgs/smol-machines/repositories

Got a lot of questions on how I spin up linux VM's so quickly

Explanation is pretty straight forward.

Linux was built in the 90s. Hardware improved more than a 1000x. Linux virtual machine startup times stayed relatively the same.

Turns out we kept adding junk to the linux kernel + bootup operations.

So all I did was cut and remove unnecessary parts until it still worked. This ended up also getting boot up times to under 1s.

Big part of it was systemd btw.

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#69

Post by binsquare »

nonameiguess wrote: post #41

What are you actually doing on top of libkrun? Providing really small machine images that boot quickly? If I run the smolvm run --image alpine example, what is "alpine?" Where is that image coming from? Does this have some built-in default registry of machine images it pulls from? Does it need an Internet connection that allows outbound access to wherever this registry runs? Is it one of a default set of pre-built im…

those images are pulling from the public docker registry.

Re: Show HN: Smol machines – subsecond coldstart, portable virtual machines

#70

Post by binsquare »

irickt wrote: post #56

Is there a relation to the similarly-purposed and similarly-named https://github.com/CelestoAI/SmolVM

no relation, they build a sandboxing service using firecracker.

I build a virtual machine that is an alternative to firecracker and containers.

Post reply on HN