Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsandbox: Virtual Machines that feel and perform like containers

github.com

Post reply on HN
Print view View original

101–110 of 195 posts

Re: Microsandbox: Virtual Machines that feel and perform like containers

#101

Post by ignoramous »

bjackman wrote: post #91
zackmorris wrote: post #81

This is great! I'd like to see a formal container security grade that works like: 1) Curate a list of all known (container) exploits 2) Run each exploit in environments of increasing security like permissions-based, jail, Docker and emulator 3) The percentage of prevented exploits would be the score from 0-100% Under this scheme, I'd expect naive attempts at containerization with permissions and jails to score around…

You cannot build a secure container runtime (against malicious containers) because underlying it is the Linux kernel. The only way to make Linux containers a meaningful sandbox is to drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value. It's no longer a "generic platform that you can throw any workload onto" but instead a bespoke thing that needs to be tuned and rec…

> ... drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value ...

Depends I guess as Android has had quite a bit of success with seccomp-bpf & Android-specific flavour of SELinux [0]

> Until we have a properly hardened and memory safe OS ... faster than running MicroVMs on a Linux host.

Andy Tanenbaum might say, Micro Kernels would do just as well.

[0] https://youtu.be/WxbOq8IGEiE

Re: Microsandbox: Virtual Machines that feel and perform like containers

#102

Post by akdev1l »

dataflow wrote: post #46
speed_spread wrote: post #43

Earlier quoted context omitted.

Creating the VM itself is fast. It depends on what you run in it. Unikernel VMs can start in a few milliseconds. For example, checkout OSv.

You're saying this is true on a Windows host?

Yes. The delay you’re complaining about happens because you are looking at general hypervisors which also come with virtualized hardware and need to mimic a bunch of stuff so that most software will work as usual.

For example: your VM starts up with the CPU in 16 bit mode because that’s just how things work in x86 and then it waits for the guest OS to set the CPU into 64 bit mode.

This is completely unnecessary if you just want to run x86-64 code in a virtualized environment and you control the guest kernel and can just assume things are in 64bit mode because it’s not the 70s or whatever

The guest OS would also need to probe few ports to get a bootable disk. If you control the kernel then you can just not do that and boot directly.

There’s a ton of stuff that isn’t needed

Re: Microsandbox: Virtual Machines that feel and perform like containers

#103

Post by dataflow »

akdev1l wrote: post #102
dataflow wrote: post #46

Earlier quoted context omitted.

You're saying this is true on a Windows host?

Yes. The delay you’re complaining about happens because you are looking at general hypervisors which also come with virtualized hardware and need to mimic a bunch of stuff so that most software will work as usual. For example: your VM starts up with the CPU in 16 bit mode because that’s just how things work in x86 and then it waits for the guest OS to set the CPU into 64 bit mode. This is completely unnecessary if yo…

The 16 bit mode stuff and the guest OS probes are after what I'm asking, not before.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#105

Post by akdev1l »

dataflow wrote: post #103
akdev1l wrote: post #102

Earlier quoted context omitted.

Yes. The delay you’re complaining about happens because you are looking at general hypervisors which also come with virtualized hardware and need to mimic a bunch of stuff so that most software will work as usual. For example: your VM starts up with the CPU in 16 bit mode because that’s just how things work in x86 and then it waits for the guest OS to set the CPU into 64 bit mode. This is completely unnecessary if yo…

The 16 bit mode stuff and the guest OS probes are after what I'm asking, not before.

No it is not. The “first instruction in the BIOS” is 16 bit mode code when dealing with an x86 VM.

A virtual environment doesn’t even really need any BIOS or anything like that.

You can feel free to test with qemu direct kernel booting to see this skips a lot of delay without even having to use a specialized hypervisor like firecracker

Re: Microsandbox: Virtual Machines that feel and perform like containers

#106

Post by gopher_space »

dataflow wrote: post #49
drewg123 wrote: post #47

Earlier quoted context omitted.

Without any context in terms of what the VM is doing or what VMM software you use, my best guess is that the OS/VMM are pre-allocating memory for the VM. This might involve paging out other processes' memory, which could take some time. I think task manager would tell you if there is a blip of memory usage and paging activity at the time. And I'm sure windows itself has profilers that can tell you what is happening w…

VirtualBox on Windows, primarily. Though I feel like haven't seen other VMs in the past start up a whole ton faster (maybe a somewhat) (ignoring WSL2). Page files are already disabled, there's plenty of free RAM, and it makes no difference how little RAM the guest is allocated (even if it's 256MB). So no, those are not the issues. VirtualBox itself seems to be doing something slow during that time and I don't know wh…

I remembered something about VirtualBox not playing nicely with Hyper-V on Windows, and dug up a possibly relevant post[0] on their forums. IIRC we ended up moving a few build systems to Docker and dropping VirtualBox because of hyper-v related issues, but it's been a few years.

[0] https://forums.virtualbox.org/viewtopic.php?t=112113

Re: Microsandbox: Virtual Machines that feel and perform like containers

#108

Post by dataflow »

gopher_space wrote: post #106
dataflow wrote: post #49

Earlier quoted context omitted.

VirtualBox on Windows, primarily. Though I feel like haven't seen other VMs in the past start up a whole ton faster (maybe a somewhat) (ignoring WSL2). Page files are already disabled, there's plenty of free RAM, and it makes no difference how little RAM the guest is allocated (even if it's 256MB). So no, those are not the issues. VirtualBox itself seems to be doing something slow during that time and I don't know wh…

I remembered something about VirtualBox not playing nicely with Hyper-V on Windows, and dug up a possibly relevant post[0] on their forums. IIRC we ended up moving a few build systems to Docker and dropping VirtualBox because of hyper-v related issues, but it's been a few years. [0] https://forums.virtualbox.org/viewtopic.php?t=112113

That's the unrelated green-turtle issue. It's only relevant after the guest has actually started running instructions. I'm talking about before that point.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#109

Post by appcypher »

simonw wrote: post #96
appcypher wrote: post #3

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

I'm trying this out now and it's very promising. One problem I'm running into with the Python library is that I'd like to keep that sandbox running for several minutes while I do things like set variables in one call and then use them for stuff several calls later. I keep seeing this error intermittently: Error: Sandbox is not started. Call start() first Is there a suggested way of keeping a sandbox around for longer…

Right. You can skip the `with` context manager and call start and stop yourself.

There is an example of that here:

https://github.com/microsandbox/microsandbox/blob/0c13fc27ab...

Re: Microsandbox: Virtual Machines that feel and perform like containers

#110

Post by amelius »

For my taste, container technology is pushing the OS too far. By typing:

    mount
you immediately see what I mean. Stuff that should be hidden is now in plain sight, and destroys the usefulness of simple system commands. And worse, the user can fiddle with the data structures. It's like giving the user peek and poke commands.

The idea of containers is nice, but they are a hack until kernels are re-architected.

Post reply on HN