Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Linux Container Runtime from Scratch

edera.dev

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Building a Linux Container Runtime from Scratch

#41

Post by sys_call »

znpy wrote: post #35
denhamparry wrote: post #29

Earlier quoted context omitted.

Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someone were to break out of a container, they'd only see the zone processes. Not the host operating system or the hardware on the machine. The key difference here between us and other isolation implementations is that there is no performance degradation, you don't…

> Edera Protect creates Zones to isolate processes from other Zones What do you mean by "zone" exactly?

A zone is jargon for a virtual machine guest environment (an homage to Solaris Zones). Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.

Re: Building a Linux Container Runtime from Scratch

#42

Post by GardenLetter27 »

flkenosad wrote: post #37
Joker_vD wrote: post #19

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.

A lot of use cases don't want that though. It's nice having lightweight network namespaces for example, just to separate the network stack for tunneling but still have X and Wayland working fine with the applications running there.

Re: Building a Linux Container Runtime from Scratch

#43

Post by eyberg »

flkenosad wrote: post #37
Joker_vD wrote: post #19

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.

When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they are required to cover is so large but more importantly it doesn't have isolation at the cpu level (eg: intel vt-x such as VMREAD, VMWRITE, VMLAUNCH, VMXOFF, VMXON).

This is what the entire public cloud is built on. You don't really read articles that often where someone is talking about breaking vm isolation on AWS and spying on the other tenants on the server.

Re: Building a Linux Container Runtime from Scratch

#44

Post by xmodem »

sys_call wrote: post #39
xmodem wrote: post #36

Earlier quoted context omitted.

What underlying primitives are you relying on to provide isolation, if not linux namespaces? How does your approach compare to Google's gVisor?

gVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace ke…

Thanks for the explanation. So you are using virtualisation-based techniques. I had incorrectly inferred from other comments that you were not.

I skimmed the paper and it suggests your hypervisor can work without CPU-based virtualisation support - that's pretty neat.

Many cloud environments do not have support for nested virtualisation extensions available (and also it tends to suck, so you shouldn't use it for production even if it is available). So there aren't many good options for running containers from different security domains on the same cloud instance. gVisor has been my go-to for that up until now. I will be sure to give this a shot!

Re: Building a Linux Container Runtime from Scratch

#45

Post by pjmlp »

shortrounddev2 wrote: post #27
pjmlp wrote: post #18

Earlier quoted context omitted.

Windows containers exist, their are based on the jobs, and Microsof took the approach to use the same APIs docker world expects to have as means to integrate with the DevOps container world expectations. https://learn.microsoft.com/en-us/virtualization/windowscont... You missed GDI+, Direct2D API is a COM mess that we only put up with because DirectX, and DirectX team doesn't like .NET, thus nothing like XNA or Manag…

While windows containers exist, the documentation surrounding them at the API level is sparse. Anything from Azure just tells you to use docker. As far as I can tell GDI+ is still software rendered? DirectX Com objects aren't difficult to work with at all, ive never understood why people hate them so much. The point of using direct2d would be to provide hardware rendering for winforms. Wpf is OK compared to winui 3 b…

Because the API was designed to be compatible with Docker tooling.

GDI and GDI+ are hardware accelerated for years now,

https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

Maybe because COM tooling sucks, in C++ land, Microsoft re-invents the approach to use COM every couple of years, and it is too much C/C++ style instead of being a proper modern C++ approach to handle COM.

While on .NET land, DirectX team couldn't care less, and leaves the community the work to make the interop work without issues.

The XAML hate comes mostly from outside traditional Windows developer circles.

Re: Building a Linux Container Runtime from Scratch

#46

Post by flaminHotSpeedo »

eyberg wrote: post #43
flkenosad wrote: post #37

Earlier quoted context omitted.

Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.

When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they are required to cover is so large but more importantly it doesn't have isolation at the cpu level (eg: intel vt-x such as VMREAD, VMWRITE, VMLAUNCH, VMXOFF, VMXON). This is what the entire pub…

> This is what the entire public cloud is built on.

Well... The entire public cloud except Azure. They've been caught multiple times for vulnerabilities stemming from the lack of hardware backed isolation between tenants.

Re: Building a Linux Container Runtime from Scratch

#47

Post by shortrounddev2 »

pjmlp wrote: post #45
shortrounddev2 wrote: post #27

Earlier quoted context omitted.

While windows containers exist, the documentation surrounding them at the API level is sparse. Anything from Azure just tells you to use docker. As far as I can tell GDI+ is still software rendered? DirectX Com objects aren't difficult to work with at all, ive never understood why people hate them so much. The point of using direct2d would be to provide hardware rendering for winforms. Wpf is OK compared to winui 3 b…

Because the API was designed to be compatible with Docker tooling. GDI and GDI+ are hardware accelerated for years now, https://learn.microsoft.com/en-us/windows-hardware/drivers/d... Maybe because COM tooling sucks, in C++ land, Microsoft re-invents the approach to use COM every couple of years, and it is too much C/C++ style instead of being a proper modern C++ approach to handle COM. While on .NET land, DirectX te…

yes but the point is to not have to use docker to containerize an app; it would be nice to be able to containerize an app with a built in runtime or something that is just literally not docker. Microsoft could solve so many of its security issues with an equivalent to Snap.

Again, I don't get what the COM hate is. In DirectX, it's basically just become a simple way to manage the life cycle of an object.

And Xaml hate is the hill I'm willing to die on. UI should be defined in either a dom or a winforms-like API, but not a mix between the two. Xaml is just straight up one of the worst things Microsoft has created

Re: Building a Linux Container Runtime from Scratch

#48

Post by 0x1ceb00da »

sys_call wrote: post #39
xmodem wrote: post #36

Earlier quoted context omitted.

What underlying primitives are you relying on to provide isolation, if not linux namespaces? How does your approach compare to Google's gVisor?

gVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace ke…

So it's a lightweight way of running docker images inside a virtual machine?

Re: Building a Linux Container Runtime from Scratch

#49

Post by [deleted] »

eyberg wrote: post #43
flkenosad wrote: post #37

Earlier quoted context omitted.

Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.

When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they are required to cover is so large but more importantly it doesn't have isolation at the cpu level (eg: intel vt-x such as VMREAD, VMWRITE, VMLAUNCH, VMXOFF, VMXON). This is what the entire pub…

[deleted]

Re: Building a Linux Container Runtime from Scratch

#50

Post by richardwhiuk »

flaminHotSpeedo wrote: post #46
eyberg wrote: post #43

Earlier quoted context omitted.

When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they are required to cover is so large but more importantly it doesn't have isolation at the cpu level (eg: intel vt-x such as VMREAD, VMWRITE, VMLAUNCH, VMXOFF, VMXON). This is what the entire pub…

> This is what the entire public cloud is built on. Well... The entire public cloud except Azure. They've been caught multiple times for vulnerabilities stemming from the lack of hardware backed isolation between tenants.

Azure has the same level of isolation for VMs at a hardware level as AWS.
Post reply on HN