Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeroVM: lightweight containers based on Google Native Client

zerovm.org

Post reply on HN
Print view View original

21–30 of 79 posts

Re: ZeroVM: lightweight containers based on Google Native Client

#21

Post by reginaldo »

icebraining wrote: post #18
reginaldo wrote: post #9

Earlier quoted context omitted.

From what I read it's something like this: It gives a bare-bones environment for you to run your programs that is presumably very low overhead. Think of it as an embedded system where programs run without an OS. This is the environment a program running inside zerovm will see. All you have is libc and the zerovm-provided APIs. If you want more, you'll have to statically link your programs. The thing is, you can run m…

Such a technology would enable neat stuff, like renting a server for someone to run a single program for some period of time and have the results sent back. Nobody does this for unrestricted programs today, for many reasons, a very important one being the fact that it would be very hard to do this in a secure way. Well, almost nobody. NearlyFreeSpeech[1] lets you compile and run unrestricted C and C++ programs on the…

Thanks for the info. Seriously I should have said "almost nobody" in the first place. In fact I thought I had said that :)

I didn't know nfshost was doing it. From what I see, they're probably using FreeBSD jails in this case, which is nice if they are.

Anyways, we have to agree that this space is largely unexplored. I never thought there was a need for this kind of service, but just after reading the ZeroVM pages I think it's a very good idea. With a "little" more initial effort, it would enable writing systems in a very interesting way: self-healing (when the other end has failed, make an API call to provision another copy of it), self-provisioning (when traffic is high, make an API call to provision another copy of a worker), etc. Of course we can already do this already, it would just be more natural, and if you combine this with the idea of Mobile Agents, then the cloud suddenly becomes much "cloudier".

Re: ZeroVM: lightweight containers based on Google Native Client

#23

Post by eklitzke »

majke wrote: post #22

If you think NaCL is bloated, Russ Cox's vx32 may be a lightweight answer: http://pdos.csail.mit.edu/~baford/vm/ Some of my experiments: http://www.lshift.net/blog/2010/03/31/what-has-happened-to-t... https://github.com/majek/vx32example

Interesting, Russ Cox works at Google. I'd have to imagine that he's talked to members of the NaCL team, and vice versa.

Re: ZeroVM: lightweight containers based on Google Native Client

#24

Post by ww520 »

StavrosK wrote: post #4

I have never read so many words and understood so little about a technology before. The density of marketing-speak per word is approximately 1. Why can't some people just explain things simply?

tl;dr It's basically a lightweight sandbox to let you run untrusted code from un-managed languages (i.e. C/C++/Assembly/etc) in the native host format (i.e. in Linux i686 or Win32 or iOS).

My comment: In other quarters, people usually use OS process plus permission to isolate the running of a untrusted program. This is basically what ZeroVM is, a more restricted process.

One major downside of this approach is that you have to compiled to different host formats to deploy to different host environments. You don't have the write once and run everywhere advantage of Java/C#/Python.

Re: ZeroVM: lightweight containers based on Google Native Client

#25

Post by ww520 »

reginaldo wrote: post #9
StavrosK wrote: post #4

I have never read so many words and understood so little about a technology before. The density of marketing-speak per word is approximately 1. Why can't some people just explain things simply?

From what I read it's something like this: It gives a bare-bones environment for you to run your programs that is presumably very low overhead. Think of it as an embedded system where programs run without an OS. This is the environment a program running inside zerovm will see. All you have is libc and the zerovm-provided APIs. If you want more, you'll have to statically link your programs. The thing is, you can run m…

Actually as long as you set up your permission correctly, you can run any untrusted user-mode C code (non-privileged code). Just deny access to most of the system except the places you let it access. Chroot actually let you emulate the system directories for the process. Set up the firewall correctly to restrict its network access.

The multi-user environment in Unix is the very old idea to let untrusted codes and untrusted programmers run wild in the same machine.

Re: ZeroVM: lightweight containers based on Google Native Client

#26

Post by ericbb »

vardump wrote: post #8

I read this as RPC with code instead of just data. If so, this is exactly what I've been looking for a long time, because traditional RPC roundtrip latency is often high - so high, that you need to create a more complicated API to avoid excess iteration. Combine this with ZeroMQ and MessagePack, and you have some serious power at your fingertips. Messages can execute at destination, do iteration, API calls and return…

Typical solution is to use an interpreter (turning data into code). How often is it necessary to run arbitrary machine code on demand?

Re: ZeroVM: lightweight containers based on Google Native Client

#28

Post by Tobu »

Tobu wrote: post #16

This is intended as a way to run computation close to data. Some databases embed Lua or pluggable languages for that; ZeroVM can run NaCL binaries (compiled with a special toolchain), verified in the same manner as the JVM checks bytecode, on a very limited sandbox (just some pre-configured data channels). Besides the NaCL verifications, they are enforcing functional programming: the program only has access to determ…

Why downvotes? I provided an explanation because the initial reaction on HN was confusion.

Re: ZeroVM: lightweight containers based on Google Native Client

#29

Post by skrebbel »

Tobu wrote: post #28
Tobu wrote: post #16

This is intended as a way to run computation close to data. Some databases embed Lua or pluggable languages for that; ZeroVM can run NaCL binaries (compiled with a special toolchain), verified in the same manner as the JVM checks bytecode, on a very limited sandbox (just some pre-configured data channels). Besides the NaCL verifications, they are enforcing functional programming: the program only has access to determ…

Why downvotes? I provided an explanation because the initial reaction on HN was confusion.

They're called the downvote mafia. Little to do about them.

Re: ZeroVM: lightweight containers based on Google Native Client

#30

Post by bradfitz »

eklitzke wrote: post #23
majke wrote: post #22

If you think NaCL is bloated, Russ Cox's vx32 may be a lightweight answer: http://pdos.csail.mit.edu/~baford/vm/ Some of my experiments: http://www.lshift.net/blog/2010/03/31/what-has-happened-to-t... https://github.com/majek/vx32example

Interesting, Russ Cox works at Google. I'd have to imagine that he's talked to members of the NaCL team, and vice versa.

He works on Go at Google. He updated an earlier version of Go to run on an earlier version of NaCL, but it's since bitrot as NaCL's formats were changing at the time.
Post reply on HN