Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeroVM – Hyperscale Cloud Infrastructure

zerovm.org

Post reply on HN
Print view View original

1–10 of 21 posts

Re: ZeroVM – Hyperscale Cloud Infrastructure

#2

Post by nl »

Ha.

I wrote about a ZeroVM-on-Docker thing I was working[1] on in another thread just before this story showed up.

Note that ZeroVM isn't a conventional VM at all. All your software needs recompiling for it, and it is entirely deterministic (with all the positive and negative aspects of that).

For one set of use-cases this is very useful. I was looking at using it to run untrusted user-submitted, and potentially hostile code when a Docker container isn't sufficient on its own.

[1] https://news.ycombinator.com/item?id=8107151

Re: ZeroVM – Hyperscale Cloud Infrastructure

#3

Post by walterbell »

nl wrote: post #2

Ha. I wrote about a ZeroVM-on-Docker thing I was working[1] on in another thread just before this story showed up. Note that ZeroVM isn't a conventional VM at all. All your software needs recompiling for it, and it is entirely deterministic (with all the positive and negative aspects of that). For one set of use-cases this is very useful. I was looking at using it to run untrusted user-submitted, and potentially host…

See also the "Containers don't contain" talk from RedHat at DockerCon:

http://blog.docker.com/2014/07/new-dockercon-video-docker-se...

http://opensource.com/business/14/7/docker-security-selinux

Re: ZeroVM – Hyperscale Cloud Infrastructure

#4

Post by nl »

walterbell wrote: post #3
nl wrote: post #2

Ha. I wrote about a ZeroVM-on-Docker thing I was working[1] on in another thread just before this story showed up. Note that ZeroVM isn't a conventional VM at all. All your software needs recompiling for it, and it is entirely deterministic (with all the positive and negative aspects of that). For one set of use-cases this is very useful. I was looking at using it to run untrusted user-submitted, and potentially host…

See also the "Containers don't contain" talk from RedHat at DockerCon: http://blog.docker.com/2014/07/new-dockercon-video-docker-se... http://opensource.com/business/14/7/docker-security-selinux

The SELinux talks looks interesting. I spent a while trying to get SELinux and Docker working together[1]. I'll need to watch that.

[1] https://groups.google.com/forum/#!searchin/docker-user/SELin...

Re: ZeroVM – Hyperscale Cloud Infrastructure

#5

Post by walterbell »

nl wrote: post #4
walterbell wrote: post #3

Earlier quoted context omitted.

See also the "Containers don't contain" talk from RedHat at DockerCon: http://blog.docker.com/2014/07/new-dockercon-video-docker-se... http://opensource.com/business/14/7/docker-security-selinux

The SELinux talks looks interesting. I spent a while trying to get SELinux and Docker working together[1]. I'll need to watch that. [1] https://groups.google.com/forum/#!searchin/docker-user/SELin...

Does anyone use AppArmor in production? It isn't very visible.

Future hardware isolation: http://css.csail.mit.edu/6.858/2013/readings/intel-sgx.pdf

Re: ZeroVM – Hyperscale Cloud Infrastructure

#6

Post by nl »

walterbell wrote: post #5
nl wrote: post #4

Earlier quoted context omitted.

The SELinux talks looks interesting. I spent a while trying to get SELinux and Docker working together[1]. I'll need to watch that. [1] https://groups.google.com/forum/#!searchin/docker-user/SELin...

Does anyone use AppArmor in production? It isn't very visible. Future hardware isolation: http://css.csail.mit.edu/6.858/2013/readings/intel-sgx.pdf

You may find MBox interesting:

Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems.

http://pdos.csail.mit.edu/mbox/

I had trouble running it in Ubuntu because of AppArmor..

Re: ZeroVM – Hyperscale Cloud Infrastructure

#7

Post by walterbell »

nl wrote: post #6
walterbell wrote: post #5

Earlier quoted context omitted.

Does anyone use AppArmor in production? It isn't very visible. Future hardware isolation: http://css.csail.mit.edu/6.858/2013/readings/intel-sgx.pdf

You may find MBox interesting: Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems. http://pdos.csail.mit.edu/mbox/ I had trouble running it in Ubuntu because of AppArmor..

Thanks. Looks like one of those voluntary rootkits that installs defensive code in a role that malware has been known to occupy. It's a good sign for AppArmor that it prevented it from running :)

Re: ZeroVM – Hyperscale Cloud Infrastructure

#8

Post by nl »

walterbell wrote: post #7
nl wrote: post #6

Earlier quoted context omitted.

You may find MBox interesting: Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems. http://pdos.csail.mit.edu/mbox/ I had trouble running it in Ubuntu because of AppArmor..

Thanks. Looks like one of those voluntary rootkits that installs defensive code in a role that malware has been known to occupy. It's a good sign for AppArmor that it prevented it from running :)

I wouldn't have said it was much like a rootkit. It's more akin to a container or a chroot, except run without special permissions.

What am I missing? (Or is it just that some rootkits use ptrace/Seccomp?)

Post reply on HN