Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

github.com

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#11

Post by rrdharan »

slpnix wrote: post #4
StreamBright wrote: post #2

What are the differences compare to Firecracker?

From the guest perspective, the differences are minimal. Even boot time of the guest (thinking about a custom-built minimalist Linux kernel here) is roughly the same. On the host side, things are more interesting. Firecraker has a smaller TCB (Trusted Computing Base), is written in Rust, and is statically linked. On the other hand, QEMU provides more features (especially in the block layer, with more formats, network…

> QEMU... has a pretty good security record

That's an interesting and I would argue, contrarian take?

https://www.theregister.co.uk/2017/01/30/google_cloud_kicked...

"QEMU has a long track record of security bugs, such as VENOM, and it's unclear what vulnerabilities may still be lurking in the code."

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#12

Post by mato »

slpnix wrote: post #4
StreamBright wrote: post #2

What are the differences compare to Firecracker?

From the guest perspective, the differences are minimal. Even boot time of the guest (thinking about a custom-built minimalist Linux kernel here) is roughly the same. On the host side, things are more interesting. Firecraker has a smaller TCB (Trusted Computing Base), is written in Rust, and is statically linked. On the other hand, QEMU provides more features (especially in the block layer, with more formats, network…

> In the end, KVM userspace VMMs (Virtual Machine Monitors) are learning from each other, giving users more options to choose from. Everybody wins.

Indeed. Nice to see that the cross-pollination is happening.

For folks interested in what can be accomplished with userspace VMMs, a very minimalist example is the Solo5 project (https://github.com/Solo5/solo5), specifically the 'hvt' tender.

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#13

Post by slpnix »

rrdharan wrote: post #11
slpnix wrote: post #4

Earlier quoted context omitted.

From the guest perspective, the differences are minimal. Even boot time of the guest (thinking about a custom-built minimalist Linux kernel here) is roughly the same. On the host side, things are more interesting. Firecraker has a smaller TCB (Trusted Computing Base), is written in Rust, and is statically linked. On the other hand, QEMU provides more features (especially in the block layer, with more formats, network…

> QEMU... has a pretty good security record That's an interesting and I would argue, contrarian take? https://www.theregister.co.uk/2017/01/30/google_cloud_kicked... "QEMU has a long track record of security bugs, such as VENOM, and it's unclear what vulnerabilities may still be lurking in the code."

I think the slide 14 from the talk "Reports of my Bloat Have Been Greatly Exaggerated" [1] presented by Paolo Bonzini at KVM Forum 2019 gives some good perspective about QEMU's security track:

"Of the top 100 vulnerabilities reported for QEMU:

- 65 were not guest exploitable

- 3 were not in QEMU :)

- 5 did not affect x86 KVM guests

- 3 were not related to the C language

- Only 6 affected devices normally used for IaaS

The most recent of these 6 was reported in 2016"

The rest of this talk was also very interesting. I encourage everyone with 10 minutes to spare and an interest in VMMs to take a look at the slides.

[1] https://static.sched.com/hosted_files/kvmforum2019/c6/kvmfor...

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#14

Post by ketralnis »

slpnix wrote: post #13
rrdharan wrote: post #11

Earlier quoted context omitted.

> QEMU... has a pretty good security record That's an interesting and I would argue, contrarian take? https://www.theregister.co.uk/2017/01/30/google_cloud_kicked... "QEMU has a long track record of security bugs, such as VENOM, and it's unclear what vulnerabilities may still be lurking in the code."

I think the slide 14 from the talk "Reports of my Bloat Have Been Greatly Exaggerated" [1] presented by Paolo Bonzini at KVM Forum 2019 gives some good perspective about QEMU's security track: "Of the top 100 vulnerabilities reported for QEMU: - 65 were not guest exploitable - 3 were not in QEMU :) - 5 did not affect x86 KVM guests - 3 were not related to the C language - Only 6 affected devices normally used for Iaa…

> "Of the top 100 vulnerabilities reported for QEMU:

> - 3 were not related to the C language

wow

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#15

Post by gigatexal »

bloopernova wrote: post #6
yjftsjthsd-h wrote: post #3

Oh, nice: props for including precise, fully worked example commands to actually use this. This is so helpful in terms of onboarding and being able to actually get people to use a project:)

If I was an eccentric billionaire, I'd reward good documentation with an open source doc prize. It's so difficult to impress upon some people just important documentation is. And when they do it, they half-ass it by copying stuff from source code and not adding any context.

+100 to this. I’ve become a cheerleader for some projects just because the documentation was so good that it was easy to get started. It’s how I became a ZFS zealot among other things.

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#16

Post by rwmj »

reilly3000 wrote: post #10

What kind of workloads make sense for this runtime? DIYFaaS? Or small, isolated long-running processes?

Function as a service is certainly one place. Others include secure container runtimes (eg. Kata-containers), sandboxing applications in general, and libguestfs.

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#17

Post by loudmax »

yjftsjthsd-h wrote: post #3

Oh, nice: props for including precise, fully worked example commands to actually use this. This is so helpful in terms of onboarding and being able to actually get people to use a project:)

I sure wish qemu were better documented. There's a lot of qemu documentation out there, but much is incomplete or out of date. A lot of Red Hat's documentation is virsh rather than qemu/kvm. It's fairly easy to get something simple up and going, but there are shortcomings when you try to do something more complicated.

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#18

Post by mato »

slpnix wrote: post #13
rrdharan wrote: post #11

Earlier quoted context omitted.

> QEMU... has a pretty good security record That's an interesting and I would argue, contrarian take? https://www.theregister.co.uk/2017/01/30/google_cloud_kicked... "QEMU has a long track record of security bugs, such as VENOM, and it's unclear what vulnerabilities may still be lurking in the code."

I think the slide 14 from the talk "Reports of my Bloat Have Been Greatly Exaggerated" [1] presented by Paolo Bonzini at KVM Forum 2019 gives some good perspective about QEMU's security track: "Of the top 100 vulnerabilities reported for QEMU: - 65 were not guest exploitable - 3 were not in QEMU :) - 5 did not affect x86 KVM guests - 3 were not related to the C language - Only 6 affected devices normally used for Iaa…

> "Of the top 100 vulnerabilities reported for QEMU:

> - 65 were not guest exploitable

> [...]

Which leaves about 30 that presumably were guest exploitable.

Don't get me wrong -- QEMU is useful. As a "kitchen sink" solution that runs anything, anywhere, with any useful combination of emulated {devices,processors,systems}.

However, this is also its biggest weakness. Which is why Google and Amazon all run their own custom VMMs for their IaaS services.

The microvm machine type as described here is a great step to improve this situation. The next step in my book would be to reconfigure QEMU's build system to allow building a binary that only supports the devices provided by microvm, and nothing else.

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#19

Post by voltagex_ »

gigatexal wrote: post #15
bloopernova wrote: post #6

Earlier quoted context omitted.

If I was an eccentric billionaire, I'd reward good documentation with an open source doc prize. It's so difficult to impress upon some people just important documentation is. And when they do it, they half-ass it by copying stuff from source code and not adding any context.

+100 to this. I’ve become a cheerleader for some projects just because the documentation was so good that it was easy to get started. It’s how I became a ZFS zealot among other things.

OT: where do you find the good ZFS documentation? Googling always seems to turn up Oracle's documentation, which may not match what's in FreeBSD or ZFS-on-Linux

Re: Show HN: microvm – a minimalist machine type for QEMU inspired by Firecracker

#20

Post by stock_toaster »

voltagex_ wrote: post #19
gigatexal wrote: post #15

Earlier quoted context omitted.

+100 to this. I’ve become a cheerleader for some projects just because the documentation was so good that it was easy to get started. It’s how I became a ZFS zealot among other things.

OT: where do you find the good ZFS documentation? Googling always seems to turn up Oracle's documentation, which may not match what's in FreeBSD or ZFS-on-Linux

The zfs man pages (at least on FreeBSD) are actually pretty decent for finding command usage. The FreeBSD handbook[1] covers some typical usages.

[1]: https://www.freebsd.org/doc/handbook/zfs.html

Post reply on HN