11–20 of 32 posts
Now that WSLg support ( https://github.com/microsoft/wslg ) has landed in a release version of windows, another approach to this is to create new WSL distros for specific tasks, and run browsers from them. Whilst it's a VM, I've found start-up time for WSL instances to be pretty quick, and it's pretty easy to create and clone a template VM (one approach https://raesene.github.io/blog/2020/05/31/Custom_Pentest_Dis...…
Now that WSLg support ( https://github.com/microsoft/wslg ) has landed in a release version of windows, another approach to this is to create new WSL distros for specific tasks, and run browsers from them. Whilst it's a VM, I've found start-up time for WSL instances to be pretty quick, and it's pretty easy to create and clone a template VM (one approach https://raesene.github.io/blog/2020/05/31/Custom_Pentest_Dis...…
Now that WSLg support ( https://github.com/microsoft/wslg ) has landed in a release version of windows, another approach to this is to create new WSL distros for specific tasks, and run browsers from them. Whilst it's a VM, I've found start-up time for WSL instances to be pretty quick, and it's pretty easy to create and clone a template VM (one approach https://raesene.github.io/blog/2020/05/31/Custom_Pentest_Dis...…
I tried doing some full-screen 3D engine development in SDL through WSL2 early this year, and stood up an X server for it. It didn't go well, so I blew away the WSL and tried running VMware Workstation 16. That was okay, but performance was surprisingly poor. I did some Googling and came to suspect that Hyper-V was the culprit. It was difficult, but I managed to extricate Hyper-V from my system and run the VMware Hyp…
Containers within VMs are a norm for security in cloud-native [1]. Some lessons there could be applied to desktop.
One option is the approach of Spectrum OS [2]. They use crosvm (same as what Firecracker "micro VMs" uses) and virtio_wl [3][4].
Another approach might be x11docker [5] with Kata Containers [6].
Curiously, the work for WSLg (WSL with graphics) [7][8] to support graphical Linux guest VMs could also be applied on a Linux host.
1: https://archive.fosdem.org/2020/schedule/event/kernel_address_space_isolation/attachments/slides/3889/export/events/attachments/kernel_address_space_isolation/slides/3889/Address_Space_Isolation_in_the_Linux_Kernel.pdf
2: https://spectrum-os.org/
3: https://spectrum-os.org/design.html
4: https://alyssa.is/using-virtio-wl/
5: https://github.com/mviereck/x11docker
6: https://katacontainers.io
7: https://github.com/microsoft/wslg
8: https://xdc2020.x.org/event/9/contributions/611/attachments/702/1298/XDC2020_-_X11_and_Wayland_applications_in_WSL.pdfNow that WSLg support ( https://github.com/microsoft/wslg ) has landed in a release version of windows, another approach to this is to create new WSL distros for specific tasks, and run browsers from them. Whilst it's a VM, I've found start-up time for WSL instances to be pretty quick, and it's pretty easy to create and clone a template VM (one approach https://raesene.github.io/blog/2020/05/31/Custom_Pentest_Dis...…
What is the RAM usage like? Does it reserve a big block?
A quick check there shows the vmmem process on my machine is sitting at 1.3GB with one WSL distribution started, which doesn't seem too bad.
Earlier quoted context omitted.
I tried doing some full-screen 3D engine development in SDL through WSL2 early this year, and stood up an X server for it. It didn't go well, so I blew away the WSL and tried running VMware Workstation 16. That was okay, but performance was surprisingly poor. I did some Googling and came to suspect that Hyper-V was the culprit. It was difficult, but I managed to extricate Hyper-V from my system and run the VMware Hyp…
I have used SDL on Windows with VC++ since 20 years now, so why bother at all with WSL?
I love this idea but it's broken a bit if webcams and mics can't be used at least for my use-case. If I had some time I'd look into extending that with this project.
Have a look at Qubes OS then : https://qubes-os.org . It's even more secure (hardware VT-d virtualization), with a nice gui and allows to use webcams and microphones securely.
Earlier quoted context omitted.
Have a look at Qubes OS then : https://qubes-os.org . It's even more secure (hardware VT-d virtualization), with a nice gui and allows to use webcams and microphones securely.
No GPU acceleration which makes it (as understandable as the choice is) kind of a pain to use.
I was just looking into various approaches to use process isolation for security on the desktop in Linux. Containers within VMs are a norm for security in cloud-native [1]. Some lessons there could be applied to desktop. One option is the approach of Spectrum OS [2]. They use crosvm (same as what Firecracker "micro VMs" uses) and virtio_wl [3][4]. Another approach might be x11docker [5] with Kata Containers [6]. Curi…
Why all the complexity? Just qemu/kvm and xpra, waypipe, whatever would be way simpler and in turn have way smaller of an attack surface. Same if you don't need virtualisation, just use bubblewrap instead of docker etc. It will even give you more fine grained control and you can just use your distributions package manager to keep everything up to date.
I was just looking into various approaches to use process isolation for security on the desktop in Linux. Containers within VMs are a norm for security in cloud-native [1]. Some lessons there could be applied to desktop. One option is the approach of Spectrum OS [2]. They use crosvm (same as what Firecracker "micro VMs" uses) and virtio_wl [3][4]. Another approach might be x11docker [5] with Kata Containers [6]. Curi…
> Another approach might be x11docker [5] with Kata Containers [6]. Why all the complexity? Just qemu/kvm and xpra, waypipe, whatever would be way simpler and in turn have way smaller of an attack surface. Same if you don't need virtualisation, just use bubblewrap instead of docker etc. It will even give you more fine grained control and you can just use your distributions package manager to keep everything up to dat…
x11docker is just a (very convenient) security layer for containers which need to expose graphics (and possibly webcam, audio, networking, clipboard, printers...). Kata Containers are just "micro VMs" where you spin up a separate kernel to drop the container into.
Bubblewrap is okay if you trust your kernel, but locking the app away in its own VM with its own kernel gives another layer to bust through.