Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EC2 Dedicated Hosts

aws.amazon.com

Post reply on HN
Print view View original

51–60 of 149 posts

Re: EC2 Dedicated Hosts

#51

Post by bonobo3000 »

andrewstuart2 wrote: post #6

Man, I'd really like to just see bare metal from them. To me that was part of the allure of containers -- so much more efficient than multiple VMs and yet you get a lot of similar benefits, as long as you don't mind some security tradeoffs. Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host.…

Would you mind explaining a little about how bare metal is different from this? Isn't a dedicated host a real physical machine?

Re: EC2 Dedicated Hosts

#52

Post by toomuchtodo »

skj wrote: post #47
toomuchtodo wrote: post #42

Earlier quoted context omitted.

Doesn't matter if the machine is taken over if its properly contained at the network level. Dedicated server hosting companies have been doing this for years .

With VMs the customer can share a physical host with others and not have security concerns. This cohosting lets aws pack customers more efficiently and have much better margins for the same quality service. With containers on bare metal, they could not cohost customers.

Uhh, even with containers you really can't cohost in a multi-tenant system. Containerization doesn't securely segregate arbitrary code in the same way traditional virtualization does, and there are still security issues with that.

I'm sure AWS is improving on this, as they need to with Lambda and its underlying containerization architecture. But everyone else? Its going to be a while before you can call it "secure".

Re: EC2 Dedicated Hosts

#53

Post by chrisseaton »

bonobo3000 wrote: post #51
andrewstuart2 wrote: post #6

Man, I'd really like to just see bare metal from them. To me that was part of the allure of containers -- so much more efficient than multiple VMs and yet you get a lot of similar benefits, as long as you don't mind some security tradeoffs. Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host.…

Would you mind explaining a little about how bare metal is different from this? Isn't a dedicated host a real physical machine?

No I think it's still virtualised isn't it? But on a machine that they guarantee only you are using?

Re: EC2 Dedicated Hosts

#54

Post by gutnor »

bonobo3000 wrote: post #51
andrewstuart2 wrote: post #6

Man, I'd really like to just see bare metal from them. To me that was part of the allure of containers -- so much more efficient than multiple VMs and yet you get a lot of similar benefits, as long as you don't mind some security tradeoffs. Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host.…

Would you mind explaining a little about how bare metal is different from this? Isn't a dedicated host a real physical machine?

You have a dedicated host to run VM but you don't really have access to the host OS and cannot run custom code on it.

Previously, your VM were allocated to a host as Amazon saw fit.

Re: EC2 Dedicated Hosts

#55

Post by yid »

andrewstuart2 wrote: post #6

Man, I'd really like to just see bare metal from them. To me that was part of the allure of containers -- so much more efficient than multiple VMs and yet you get a lot of similar benefits, as long as you don't mind some security tradeoffs. Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host.…

> Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host.

The cloud is great for distributed systems, and for these the "kernel on a kernel" cost becomes insignificant with the additional power allowed by the horizontal scalability of letting multiple computers talk over a network (not to mention network latency).

I'd be willing to bet that running on absolute bare metal is a sort of niche market in cloud computing that Amazon considers too small to get into.

Re: EC2 Dedicated Hosts

#56

Post by vidarh »

cstejerean wrote: post #34
fpp wrote: post #26

Earlier quoted context omitted.

Their example dedicated host adds up to $2'226 per month - had a quick calc on the retail HW cost for a machine like this - should not be more than $6.5k with 2 * E5-2670 v3 12 cores. What I understand so far - it is physically bundling a fixed amount of virtual machines to a physical host - in the example "dedicated host" 22 * m4.large. Bundling your virtual machine to one or a series of physical hosts / on the same…

You are looking at their on-demand rates, which means no commitment. You can do this for a month or even a few days. If you know you will need infra for 1 year or more you can use reserved rates. Right now those are not yet publicly available for Dedicated Instances, although the post mentions you can contact them if you want early access. With reserved rates the price should be 70% less for a 3 year commitment (spec…

But I can still for most things get lower prices on a month by month basis than the price a 3 year commitment to Amazon gets you. And that's before paying their outright extortionate bandwidth prices.

Re: EC2 Dedicated Hosts

#57

Post by cortesoft »

jeffbarr wrote: post #16
idlewords wrote: post #5

All the advantages of a dedicated server without the hassle of saving tons of money.

Many of our customers have asked for this feature so that they can run software that is licensed for a particular piece of actual hardware.

So it is a feature designed for a silly license scheme?

Re: EC2 Dedicated Hosts

#58

Post by paulannesley »

toomuchtodo wrote: post #42
omarforgotpwd wrote: post #35

Earlier quoted context omitted.

I'm sure Amazon would love it too (think about how much money they could save / make) but there are a lot of security concerns that need to be addressed. Running code in a virtualized kernel is a lot more secure than running in the real kernel with permissions limited. Theoretically an exploit could allow someone to take over the machine, whereas if the machine is virtualized it's much harder to take over the host.

Doesn't matter if the machine is taken over if its properly contained at the network level. Dedicated server hosting companies have been doing this for years .

Unless “the machine is taken over” means firmware-level compromise (e.g. disk controller, NIC controller, …), in which case the next customer allocated to that machine can be compromised despite full disk erase between customers.

Re: EC2 Dedicated Hosts

#59

Post by toomuchtodo »

paulannesley wrote: post #58
toomuchtodo wrote: post #42

Earlier quoted context omitted.

Doesn't matter if the machine is taken over if its properly contained at the network level. Dedicated server hosting companies have been doing this for years .

Unless “the machine is taken over” means firmware-level compromise (e.g. disk controller, NIC controller, …), in which case the next customer allocated to that machine can be compromised despite full disk erase between customers.

I'll agree with this attack vector, although it'd be trivial to have your PXE boot routine between customers re-apply known good firmware to the NIC and disk controller and verify with checksums (unless there's a 0-day out there for the NIC controller, in which case you're owned regardless).

Re: EC2 Dedicated Hosts

#60

Post by nowarninglabel »

No one's mentioned this as a potential use case, so wondering if other people have a way to solve a problem I have...we spin up EC2 instances on the fly for running tests, but some of those require a dedicated IP address to deal with a vendor integration. Seems like a dedicated host might solve that, though perhaps not worth the cost. Is there some other way people solve this problem? We currently have an in-house box just for running those IP limited tests.
Post reply on HN