Firecracker: Secure and fast microVMs for serverless computing

#1

Post by based2 » Sat, Mar 07, 2020, 4:02 PM UTC

Firecracker: Secure and fast microVMs for serverless computing
firecracker-microvm.github.io

Re: Firecracker: Secure and fast microVMs for serverless computing

#2

Post by rvz » Sat, Mar 07, 2020, 4:25 PM UTC

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview.

Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough.

Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by security researchers which have cataclysmic implications for users and server providers these days. This is demonstrated by a ridiculous Intel vulnerability which rendered Apple's FileVault encryption facilities completely useless which is absolutely unacceptable to Apple. There are many other CPU vulnerabilities waiting to be found and it could be the next Meltdown-like candidate.

The sooner the move to AMD or RISC-V open technologies, the better for developers and users.

Re: Firecracker: Secure and fast microVMs for serverless computing

#3

Post by mrkurt » Sat, Mar 07, 2020, 4:57 PM UTC

Firecracker is great We use it to run fleets of fast booting vms at https://fly.io.

It’s really the best OSS to come out of Amazon.

Re: Firecracker: Secure and fast microVMs for serverless computing

#4

Post by dualboot » Sat, Mar 07, 2020, 4:59 PM UTC

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

Intel has been an absolute security shit-show for over 3 years now.

The shift is underway but it takes time.

Re: Firecracker: Secure and fast microVMs for serverless computing

#5

Post by karambahh » Sat, Mar 07, 2020, 5:00 PM UTC

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

I am actually surprised by the absence of AMD support for a project born at AWS. AWS has been offering AMD Epyc ec2 instances for quite awhile[0].

Missing arm support is also suprising but less so, as arm market penetration is obviously lower than x64

[0]https://aws.amazon.com/fr/ec2/amd/

Re: Firecracker: Secure and fast microVMs for serverless computing

#6

Post by mrkurt » Sat, Mar 07, 2020, 5:03 PM UTC

karambahh wrote: post #5

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

I am actually surprised by the absence of AMD support for a project born at AWS. AWS has been offering AMD Epyc ec2 instances for quite awhile[0]. Missing arm support is also suprising but less so, as arm market penetration is obviously lower than x64 [0] https://aws.amazon.com/fr/ec2/amd/

AMD processors work fine with Firecracker, support is relatively recent though so they’re being conservative about calling it production ready.

Re: Firecracker: Secure and fast microVMs for serverless computing

#7

Post by bluk » Sat, Mar 07, 2020, 5:09 PM UTC

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

Regarding the Apple's FileVault bit, are you referring to the recently disclosed Intel vulnerability ( https://www.theregister.co.uk/2020/03/05/unfixable_intel_csm... ). Did FileVault ever use this Intel feature (even on non-T2 Macs)? It seems that there is some contention on Twitter whether FileVault is affected.

Re: Firecracker: Secure and fast microVMs for serverless computing

#8

Post by vorticalbox » Sat, Mar 07, 2020, 5:13 PM UTC

dualboot wrote: post #4

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

Intel has been an absolute security shit-show for over 3 years now. The shift is underway but it takes time.

Meltdown effects all the way back to 2nd gen(2010), it's been bad for a decade we just didn't know.

Re: Firecracker: Secure and fast microVMs for serverless computing

#9

Post by infotogivenm » Sat, Mar 07, 2020, 5:18 PM UTC

bluk wrote: post #7

rvz wrote: post #2

> Intel processors are supported for production workloads. Support for AMD and Arm processors is in developer preview. Firecracker looks very promising from a server-side technology stand-point but the support for AMD, RISC-V platforms couldn't be stressed more enough. Amazon better find a way of supporting AMD processors since Intel's CPU bugs are being brought into the sunlight and exploited in all directions by se…

Regarding the Apple's FileVault bit, are you referring to the recently disclosed Intel vulnerability ( https://www.theregister.co.uk/2020/03/05/unfixable_intel_csm... ). Did FileVault ever use this Intel feature (even on non-T2 Macs)? It seems that there is some contention on Twitter whether FileVault is affected.

Besides that... “completely useless?” Is that right? The only way you make disk encryption totally useless is by breaking the crypto. This allows an evil maid attack at best... a very different vector for most people than “completely useless”.

Re: Firecracker: Secure and fast microVMs for serverless computing

#10

Post by ausjke » Sat, Mar 07, 2020, 5:26 PM UTC

docker is used for microservices, is firecraker designed for serverless applications? what's the key difference between firecracker and docker? are these two overlapped?