Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Linux Container Runtime from Scratch

edera.dev

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Building a Linux Container Runtime from Scratch

#61

Post by sys_call »

0x1ceb00da wrote: post #48
sys_call wrote: post #39

Earlier quoted context omitted.

gVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace ke…

So it's a lightweight way of running docker images inside a virtual machine?

Yes, precisely. This also provides container operators with the benefits of a hypervisor, like memory ballooning, and dynamically allocating CPU and memory to workloads, improving resource utilization and the current node overprovisioning patterns.

Re: Building a Linux Container Runtime from Scratch

#62

Post by sys_call »

klysm wrote: post #54
sys_call wrote: post #41

Earlier quoted context omitted.

A zone is jargon for a virtual machine guest environment (an homage to Solaris Zones). Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.

How exactly is this an improvement over VMs?

We run unmodified containers in a VM guest environment, so you get the developer ergonomics of containers with the security and hardware controls of a VMM.

Re: Building a Linux Container Runtime from Scratch

#63

Post by znpy »

sys_call wrote: post #41
znpy wrote: post #35

Earlier quoted context omitted.

> Edera Protect creates Zones to isolate processes from other Zones What do you mean by "zone" exactly?

A zone is jargon for a virtual machine guest environment (an homage to Solaris Zones). Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.

> an homage to Solaris Zones

i asked specifically because the word "zones" reminded me of solaris zones :)

> Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.

do your have your own vmm or is it firecracker with make up and a wig?

Re: Building a Linux Container Runtime from Scratch

#65

Post by shortrounddev2 »

pjmlp wrote: post #45
shortrounddev2 wrote: post #27

Earlier quoted context omitted.

While windows containers exist, the documentation surrounding them at the API level is sparse. Anything from Azure just tells you to use docker. As far as I can tell GDI+ is still software rendered? DirectX Com objects aren't difficult to work with at all, ive never understood why people hate them so much. The point of using direct2d would be to provide hardware rendering for winforms. Wpf is OK compared to winui 3 b…

Because the API was designed to be compatible with Docker tooling. GDI and GDI+ are hardware accelerated for years now, https://learn.microsoft.com/en-us/windows-hardware/drivers/d... Maybe because COM tooling sucks, in C++ land, Microsoft re-invents the approach to use COM every couple of years, and it is too much C/C++ style instead of being a proper modern C++ approach to handle COM. While on .NET land, DirectX te…

Also the hardware acceleration in gdi and especially gdi+ is not totally complete. Text rendering in gdi+ is still handled in software and only some operations in gdi are hardware acclerated

Re: Building a Linux Container Runtime from Scratch

#66

Post by cedws »

denhamparry wrote: post #30
cedws wrote: post #17

Isn’t the gold standard of containerisation gVisor? Can’t get much more restrictive than proxying and filtering syscalls. As far as I remember it’s the default runtime on GKE.

Edera developer here. gVisor is restrictive, but its at a cost of performance. Personally, I'd say Edera Protect is one level deeper. We create Edera Protect Zones to provide isolation, so we create a Zone that is isolated from the OS and hardware of the machine running the container. So we don't proxy or filter syscalls, as the isolation is a layer deeper. We are also focused on ensuring that Edera Protect is as per…

Thanks, but what is a “Protect Zone” at a technical level? Why does it provider stronger isolation than syscall filtering?

Re: Building a Linux Container Runtime from Scratch

#67

Post by fulafel »

flkenosad wrote: post #37
Joker_vD wrote: post #19

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.

Have a look at gVisor for one approach.

Re: Building a Linux Container Runtime from Scratch

#68

Post by richardwhiuk »

flaminHotSpeedo wrote: post #56
richardwhiuk wrote: post #50

Earlier quoted context omitted.

Azure has the same level of isolation for VMs at a hardware level as AWS.

How Azure isolates VM's is completely unrelated, because containers are not VM's . And if you meant to assert that Azure uses hardware assisted isolation between tenants in general, that was not the case for azurescape [1] or chaosDB [2]. [1] https://unit42.paloaltonetworks.com/azure-container-instance... [2] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

It is the case for VMs that customers create.

It hasn't always been the case for manged services, but I don't think that's true for AWS either.

Re: Building a Linux Container Runtime from Scratch

#69

Post by flaminHotSpeedo »

richardwhiuk wrote: post #68
flaminHotSpeedo wrote: post #56

Earlier quoted context omitted.

How Azure isolates VM's is completely unrelated, because containers are not VM's . And if you meant to assert that Azure uses hardware assisted isolation between tenants in general, that was not the case for azurescape [1] or chaosDB [2]. [1] https://unit42.paloaltonetworks.com/azure-container-instance... [2] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

It is the case for VMs that customers create. It hasn't always been the case for manged services, but I don't think that's true for AWS either.

Unmanaged VM's created directly by customers still aren't relevant to this discussion. The whole point here is that everyone else uses some form of hardware assisted isolation between tenants, even in managed services that vend containers or other higher order compute primitives (i.e. Lambda, Cloud Functions, and hosted notebooks/shells).

Between first and second hand experience I can confidently say that, at a bare minimum, the majority of managed services at AWS, GCP, and even OCI use VM's to isolate tenant workloads. Not sure about OCI, but at least in GCP and AWS, security teams that review your service will assume that customers will break out of containers no matter how the container capabilities/permissions/configs are locked down.

Re: Building a Linux Container Runtime from Scratch

#70

Post by r3trohack3r »

denhamparry wrote: post #31
r3trohack3r wrote: post #3

Earlier quoted context omitted.

I’m currently exploring this for an AI context because I haven’t found a better solution for letting K8S manage AI workloads that need direct GPU access on OSx

Edera developer here. Edera Protect is being developed to manage access to the GPU hardware on a Node with the containers running your workloads. We talk a lot about isolation between containers, but we're also focused on adding this isolation throughout the stack, from containers/processes down to hardware.

Sounds compelling - I can’t see any mention of apple silicon on your site, any intention of supporting it?
Post reply on HN