Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Containers in 2019: They're Calling It a Hypervisor Comeback

infoq.com

Post reply on HN
Print view View original

91–100 of 196 posts

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#91

Post by eyberg »

sansnomme wrote: post #86
eyberg wrote: post #61

Earlier quoted context omitted.

Deploying a hypervisor on top of a hypervisor (eg: a public cloud) usually makes very little sense so I don't see that as a trend. However, outside of the valley bubble many large sectors of the economy do not use public clouds (such as banking, health, defense) so hypervisors typically in the form of ESX is still very much a thing and now that we are seeing tighter integration with things like unikernels that is whe…

Hypervisor on hypervisor makes sense if you care about security. Your average FaaS-on-Kubernetes hosting services not from one of the tech giants is a far cry from AWS Firecracker (Lambda) level of isolation. E.g. you run a gaming server and wants to allow arbitrary user plugins, or perhaps a challenger fintech bank that wants some simple user scripting. You want to allow Python/Ruby/any lang except Lua/JS/WASM. You…

I totally agree that if you care about security you should be running in the opposite direction of k8s.

Google Cloud has this option (nested hypervisors) but not for security reasons - it's used to run other software that comes packaged as a vm yet that comes with a serious perf hit and which is why I don't see that ever catching on as a trend. Selling bare metal servers w/pre-installed hosted firecracker would make much more sense (if you want/need hosting).

If you are interested in isolating a particular application to a given interpreter or a given binary the aforementioned unikernels are precisely what you are looking for and those can be provisioned on t2.micros.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#92

Post by zzzcpan »

sansnomme wrote: post #90
zzzcpan wrote: post #88

Earlier quoted context omitted.

It's feasible in the same way bounds checking is feasible. Everything could have a capability token attached to it and checked. Compiler could generate all the language level checks, kernel could do OS level checks. Main program could have some built in capabilities and capabilities it gets from the other OS processes, it could then pass them or devise new ones to library functions, they could pass them to other libr…

But that means you have to upload raw source code. It's closer to Apple's app store deployment than to what current cloud hosting offers (arbitrary compute power for anything but crypto mining).

Not necessarily raw source code, could be a code compiled into an intermediate representation, but it has to have capability-based security deeply integrated into it, like bounds checking is into programming languages.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#93

Post by no_wizard »

dopylitty wrote: post #52

I've had this sneaking but hard to articulate suspicion that datacenters, bare metal servers, VMs, operating systems, containers, OS processes, language VMs, and threads are all really attempts to abstract the same thing. You want to run business code in a way that's protected from other business code but also able to interact with other business code and data in a well defined way. I also have this sneaking suspicio…

What I’ve always failed to Understand is how FreeBSD jails[0] never got very popular (discounting the fact that FreeBSD isn’t very popular on the whole from what I can tell) but Docker is huge. I personally think jails are superior in implementation in that it requires no other abstractions on top of the OS.

The only thing I can surmise is that Docker might have a better secure default, but improvements to Jails could emulate that, and following best practices as well should. Beyond that I’m still baffled how this didn’t take to the mainstream.

[0] https://www.freebsd.org/doc/handbook/jails.html

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#94

Post by sansnomme »

eyberg wrote: post #91
sansnomme wrote: post #86

Earlier quoted context omitted.

Hypervisor on hypervisor makes sense if you care about security. Your average FaaS-on-Kubernetes hosting services not from one of the tech giants is a far cry from AWS Firecracker (Lambda) level of isolation. E.g. you run a gaming server and wants to allow arbitrary user plugins, or perhaps a challenger fintech bank that wants some simple user scripting. You want to allow Python/Ruby/any lang except Lua/JS/WASM. You…

I totally agree that if you care about security you should be running in the opposite direction of k8s. Google Cloud has this option (nested hypervisors) but not for security reasons - it's used to run other software that comes packaged as a vm yet that comes with a serious perf hit and which is why I don't see that ever catching on as a trend. Selling bare metal servers w/pre-installed hosted firecracker would make…

Your analysis is on point and brilliant. I would upvote this more if I could. Not enough people on HN understand the weaknesses of Kubernetes and existing self-hosted cloud software. (And more importantly, what hypervisors brings to the table)

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#95

Post by beaconstudios »

no_wizard wrote: post #93
dopylitty wrote: post #52

I've had this sneaking but hard to articulate suspicion that datacenters, bare metal servers, VMs, operating systems, containers, OS processes, language VMs, and threads are all really attempts to abstract the same thing. You want to run business code in a way that's protected from other business code but also able to interact with other business code and data in a well defined way. I also have this sneaking suspicio…

What I’ve always failed to Understand is how FreeBSD jails[0] never got very popular (discounting the fact that FreeBSD isn’t very popular on the whole from what I can tell) but Docker is huge. I personally think jails are superior in implementation in that it requires no other abstractions on top of the OS. The only thing I can surmise is that Docker might have a better secure default, but improvements to Jails coul…

better marketing I would assume.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#96

Post by angry_octet »

naasking wrote: post #31
nunchuckninja wrote: post #23

So I read something succinct a while back - docker et al are distribution platforms not security platforms . They add "0" security against an adversary (think padlocks). How true is it ? And what high perf securely contained systems are there? OpenVZ?

Sandstorm has had a pretty good track record [1]. Then again, it was designed and run by capability security folks, who take security pretty seriously. [1] https://sandstorm.io/

Unfortunately it is shutting down.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#97

Post by aritmo »

upofadown wrote: post #27
nunchuckninja wrote: post #23

So I read something succinct a while back - docker et al are distribution platforms not security platforms . They add "0" security against an adversary (think padlocks). How true is it ? And what high perf securely contained systems are there? OpenVZ?

The generic issue seems to be that stuff like containers can be escaped with pretty much any privilege escalation exploit ... and such exploits are reasonably common in the world of Linux.

But if the container is unprivileged?

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#98

Post by dasil003 »

no_wizard wrote: post #93
dopylitty wrote: post #52

I've had this sneaking but hard to articulate suspicion that datacenters, bare metal servers, VMs, operating systems, containers, OS processes, language VMs, and threads are all really attempts to abstract the same thing. You want to run business code in a way that's protected from other business code but also able to interact with other business code and data in a well defined way. I also have this sneaking suspicio…

What I’ve always failed to Understand is how FreeBSD jails[0] never got very popular (discounting the fact that FreeBSD isn’t very popular on the whole from what I can tell) but Docker is huge. I personally think jails are superior in implementation in that it requires no other abstractions on top of the OS. The only thing I can surmise is that Docker might have a better secure default, but improvements to Jails coul…

Because Docker has better dev marketing. Some sizable portion of developers actually believe Docker invented containers.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#100

Post by zzzcpan »

no_wizard wrote: post #93
dopylitty wrote: post #52

I've had this sneaking but hard to articulate suspicion that datacenters, bare metal servers, VMs, operating systems, containers, OS processes, language VMs, and threads are all really attempts to abstract the same thing. You want to run business code in a way that's protected from other business code but also able to interact with other business code and data in a well defined way. I also have this sneaking suspicio…

What I’ve always failed to Understand is how FreeBSD jails[0] never got very popular (discounting the fact that FreeBSD isn’t very popular on the whole from what I can tell) but Docker is huge. I personally think jails are superior in implementation in that it requires no other abstractions on top of the OS. The only thing I can surmise is that Docker might have a better secure default, but improvements to Jails coul…

Jails are more like runC, container tech behind Docker.
Post reply on HN