Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

141–150 of 184 posts

Re: My VM is lighter (and safer) than your container (2017)

#141

Post by TrueDuality »

There is a lot of discussion on here about the different isolation levels available, but these micro-VMs aren't playing in the same field and can't be compared apples-to-apples.

If you go read the paper this requires a specialized Xen kernel, which in turn requires processor virtualization extensions directly available where you're running these containers. Those extensions aren't generally available if you're already running inside of a VM.

This is a solution that only works on bare metal which I would bet money the vast majority of people using containers, outside of development environments at least, are not running their containers in bare metal but in an existing VM such as on AWS or GCP where this solution is simply a non-starter.

Neat, niche, and doesn't operate in the same world as containers.

Re: My VM is lighter (and safer) than your container (2017)

#142

Post by sureglymop »

epr wrote: post #29

No mention of user namespaces whatsoever, which is the primary security isolation mechanism for containers on linux. This is what enables "rootless" mode. Of course, this is from 2017, but user namespaces were released with linux 3.8 in February 2013. Docker particularly has always required extra work to run in rootless mode because it was released soon after in March 2013, and for whatever reason it hasn't been a pr…

Nowadays it is fairly straightforward to set up docker in rootless mode.

Re: My VM is lighter (and safer) than your container (2017)

#143

Post by macspoofing »

Cthulhu_ wrote: post #20
codedokode wrote: post #16

"VM" means it has its own kernel? Why have 2 kernels on the same machine? All processes in a proper OS are already isolated and there is no need for VM.

Isolated, but are they isolated enough? The article states that containers offer weaker isolation than VMs. (it doesn't quantify it though and I don't know this kind of thing offhand)

Who is complaining? And if containers do not offer enough of an isolation, why would you think VMs do? There are use cases where you have to have host-level isolation - for example, if you want to build a HIPAA-compliant cloud service, your customer data has to be isolated at the host level and VMs are not enough.

Re: My VM is lighter (and safer) than your container (2017)

#144

Post by bayindirh »

vilunov wrote: post #133
bayindirh wrote: post #122

Earlier quoted context omitted.

It's an incidental security boundary because CGroups happen to isolate the process fairly well .

Yeah, but that's not an incidental property of *namespaces* (of which cgroups is only one isolation axis), that was the requirement when namespaces were designed.

Yeah, I know. Namespaces are pretty cool outside containers too.

My comment was more of a soft jab against using containers as the ultimate "thing" for anything and everything. I prefer to use them as "statically linked binaries" for short lived processes (like document building, etc.).

But, whenever someone abuses containers (like adding an HTTPs fronting container in front of anything which can handle HTTPS on its own) I'm displeased.

Relevant XKCD: https://xkcd.com/1988/

Re: My VM is lighter (and safer) than your container (2017)

#146

Post by ajross »

bayindirh wrote: post #122
scarby2 wrote: post #109

Earlier quoted context omitted.

> It's not a security boundary. It is a security boundary, just not necessarily the best one.

It's an incidental security boundary because CGroups happen to isolate the process fairly well .

All security boundaries are "incidental" in that sense, though. Virtualization isn't a "purpose-designed" security boundary either, most of the time it's deployed for non-security reasons and the original motivation was software compatibility management.

The snobbery deployed in this "containers vs. VMs" argument really gets out of hand sometimes. Especially since it's almost never deployed symmetrically. Would you make the same argument against using a BSD jail? Do you refuse to run your services in a separate UID because it's not as secure as a container (or jail, or VM)? Of course not. Pick the tools that match the problem, don't be a zealot.

Re: My VM is lighter (and safer) than your container (2017)

#147

Post by epr »

sureglymop wrote: post #142
epr wrote: post #29

No mention of user namespaces whatsoever, which is the primary security isolation mechanism for containers on linux. This is what enables "rootless" mode. Of course, this is from 2017, but user namespaces were released with linux 3.8 in February 2013. Docker particularly has always required extra work to run in rootless mode because it was released soon after in March 2013, and for whatever reason it hasn't been a pr…

Nowadays it is fairly straightforward to set up docker in rootless mode.

Exactly, "set up". Many people (not all) don't want to fiddle with things, they just want it to work out of the box. The importance of secure defaults can't be overstated, especially when there are virtually no downsides.

Re: My VM is lighter (and safer) than your container (2017)

#149

Post by vilunov »

clan wrote: post #138
vilunov wrote: post #123

Earlier quoted context omitted.

I guess this came to be due to the poor original security model of classic OSs, which led to prolification of viruses and complex management of shared resources. Users, groups and access flags are not enough to manage security of a system. Linux tried to fix that with namespaces and it turned out to be more or less successful, but Linux is not an OS, it's just a kernel, and it's up to real OSs built atop Linux to use…

I say this with great care as I do not want to launch a flamewar. If you do not consider Linux with namespaces an OS (because of fragmented userland): Would you then consider FreeBSD with jails or Solaris with zones for fully fledged? If you still consider those flawed (maybe because thet do not force you into jails/zones) should we at least no consider OS/390 or z/OS as proper operating systems to that/your (not mea…

Isolation mechanisms is not what makes an OS. It's the stable ABI that application developers can depend on and which provides a way to use shared resources: disk, CPU, RAM, GPU, network, screen space, push notifications, GUI integrations, your favorite LLM integration, so on, so forth... Yes, it might have an imperfect security model, but nothing's perfect under the sun.

Raw Linux without userspace could be considered an OS, but it has the ABI only in form of syscalls and the minimal standard FS. That's barely enough for anything other than, say, a statically linked Go binary, which is why it's seldom used by app developers as a target.

To most of your examples I say – yes, that's an OS, and jails or zones have nothing to do with it. Although I'm not familiar with them other than FreeBSD, so I'm relying on your short description and your implied criteria for selecting these examples.

Re: My VM is lighter (and safer) than your container (2017)

#150

Post by bayindirh »

ajross wrote: post #146
bayindirh wrote: post #122

Earlier quoted context omitted.

It's an incidental security boundary because CGroups happen to isolate the process fairly well .

All security boundaries are "incidental" in that sense, though. Virtualization isn't a "purpose-designed" security boundary either, most of the time it's deployed for non-security reasons and the original motivation was software compatibility management. The snobbery deployed in this "containers vs. VMs" argument really gets out of hand sometimes. Especially since it's almost never deployed symmetrically. Would you m…

> All security boundaries are "incidental" in that sense, though

X86 protected mode, processor rings, user isolation in the multi user operating systems, secure execution environments in X86 and ARM ISAs, kernel and userspace isolation, etc. are purpose built security boundaries.

Virtualization is actually built to allow better utilization of servers, which is built as a "nested protected mode", but had great overhead in the beginning, which has been reduced over generations. Containers are just BSD jails, ported to Linux. This doesn't make containers bad, however. They're a cool tech, but held very wrong in some cases because of laziness.

Post reply on HN