Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

81–90 of 111 posts

Re: My VM is lighter (and safer) than your container (2017)

#81

Post by eyberg »

Sohcahtoa82 wrote: post #34

> We achieve lightweight VMs by using unikernels When I attended Infiltrate a few years ago, there was a talk about unikernels. The speaker showed off how incredibly insecure many of them were, not even offering support for basic modern security features like DEP and ALSR. Have they changed? Or did the speaker likely just cherry-pick some especially bad ones?

You are probably talking about this: https://research.nccgroup.com/wp-content/uploads/2020/07/ncc...

In short - not a fundamental limitation - just that kernels (even if they are small) have a ton of work that goes into them. Nanos for instance has page protections, ASLR, virtio-rng (if on GCP), etc.

Re: My VM is lighter (and safer) than your container (2017)

#83

Post by Morgawr »

gavinray wrote: post #39

The issue with unikernels and things like Firecracker are that you can't run them on already-virtualized platforms I researched Firecracker when I was looking for an alternative to Docker for deploying FaaS functions on an OpenFaaS-like clone I was building It would have worked great if the target deployment was bare metal but if you're asking a user to deploy on IE an EC2 or Fargate or whatnot, you can't use these t…

> The issue with unikernels and things like Firecracker are that you can't run them on already-virtualized platforms

I'm not sure about Firecrackers and it has to be enabled on the platform level but there are tricks you can use to run pseudo-nested VMs that look like they are nested without actually incurring into any nested virtualization overhead. This is something that some of us (crosvm) are exploring and playing around with a virtio-vhost-user (VVU) [0] proxy to basically set up a "sibling" (not nested) VM that runs its virtio device drivers into another VM without incurring into nested virtualization issues.

Firecrackers being originally based on a fork of crosvm might even benefit from this if they ever decide to play around this space, but also it'd need to be enabled on the platform level.

It's funny seeing stuff like a VVU implementation of vhost-vsock effectively run on a second VM and provide what seems to be a nested virtualization environment between two completely separate VMs. You get funky stuff like the other sibling VM's host address (cid = 2) becomes a non-parent VM so it looks 100% like a nested VM without nested virtualization performance hits.

[0] - https://crosvm.dev/book/devices/vvu.html

Re: My VM is lighter (and safer) than your container (2017)

#84

Post by llllIIIIllll »

xahrepap wrote: post #41

This reminds me: in 2015 I went to Dockercon and one booth that was fun was VMWare's. Basically they had implemented the Docker APIs on top of VMWare so that they could build and deploy VMs using Dockerfiles, etc. I've casually searched for it in the past and it seems to not exist anymore. For me, one of the best parts of Docker is building a docker-image (and sharing how it was done via git). It would be cool to be…

https://github.com/weaveworks/ignite can apparently do this. It looks exciting!

Re: My VM is lighter (and safer) than your container (2017)

#85

Post by stavros »

bongobingo1 wrote: post #13

I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups. So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target othe…

I was in the same boat as you and built something simple that I really like:

https://gitlab.com/stavros/harbormaster

It'll just pull some repos, make sure the containers are up, and make your configuration simple and discoverable. It really works great at that.

Re: My VM is lighter (and safer) than your container (2017)

#86

Post by OrvalWintermute »

JeanSebTr wrote: post #12
fnord123 wrote: post #2

Title is kinda clickbaity (wha-? how can a VM be lighter than a container). It's about unikernels.

Exactly, unikernels are great for performance and isolation, but that can't be compared to a full application stack running in a container or VM.

Not all containers are a "full application stack"

A unikernel can definitely be compared.

Re: My VM is lighter (and safer) than your container (2017)

#87

Post by pphysch »

hinkley wrote: post #56
All4All wrote: post #45

Earlier quoted context omitted.

Isn't that essentially what Vagrant and Vagrantfiles do?

What is your theory for why Docker won and Vagrant didn't? Mine is that all of the previous options were too Turing Complete, while the Dockerfile format more closely follows the Principle of Least Power. Power users always complain about how their awesome tool gets ignored while 'lesser' tools become popular. And then they put so much energy into apologizing for problems with the tool or deflecting by denigrating th…

The easier it is for a technology to accidentally make it into production, the more popular it will be

Re: My VM is lighter (and safer) than your container (2017)

#88

Post by naikrovek »

xahrepap wrote: post #41

This reminds me: in 2015 I went to Dockercon and one booth that was fun was VMWare's. Basically they had implemented the Docker APIs on top of VMWare so that they could build and deploy VMs using Dockerfiles, etc. I've casually searched for it in the past and it seems to not exist anymore. For me, one of the best parts of Docker is building a docker-image (and sharing how it was done via git). It would be cool to be…

github.com/cirruslabs/tart does this for macos VMs. you push them to and pull them from OCI registries.

Re: My VM is lighter (and safer) than your container (2017)

#89

Post by galangalalgol »

convolvatron wrote: post #51
evol262 wrote: post #49

Earlier quoted context omitted.

Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…

in a related vein, most of the distinctions that are being brought up around containers vs vms (pricing, debugability, tooling, overhead) are nothing fundamental at all. they are both executable formats that cut at different layers, and there is really no reason why features of one can't be easily brought to the other. operating above these abstractions can save us time, but please stop confusing the artifacts of imp…

How would you compare the security of running in wasmer vs the other two options. I know it is a bit apples and oranges. Just curious if it would be harder to break out of a wasm sandbox, or a vm.

Re: My VM is lighter (and safer) than your container (2017)

#90

Post by OrvalWintermute »

eyberg wrote: post #81
Sohcahtoa82 wrote: post #34

> We achieve lightweight VMs by using unikernels When I attended Infiltrate a few years ago, there was a talk about unikernels. The speaker showed off how incredibly insecure many of them were, not even offering support for basic modern security features like DEP and ALSR. Have they changed? Or did the speaker likely just cherry-pick some especially bad ones?

You are probably talking about this: https://research.nccgroup.com/wp-content/uploads/2020/07/ncc... In short - not a fundamental limitation - just that kernels (even if they are small) have a ton of work that goes into them. Nanos for instance has page protections, ASLR, virtio-rng (if on GCP), etc.

I thought that presentation was a little like looking at a hobby OS of a type, then attempting to draw security conclusions for all of that type.

The NanoVMs unikernel for example, is pretty small, DoD supported, and has:

ASLR

    Stack Randomization
    Heap Randomization
    Library Randomization
    Executable Randomization
Page Protections

    Stack Execution off by Default
    Heap Execution off by Default
    Null Page is Not Mapped
    Stack Cookies/Canaries
    Rodata no execute
    Text no write
STIG
Post reply on HN