Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsandbox: Virtual Machines that feel and perform like containers

github.com

Post reply on HN
Print view View original

131–140 of 195 posts

Re: Microsandbox: Virtual Machines that feel and perform like containers

#131

Post by apitman »

SwiftyBug wrote: post #62

Kind of almost off-topic: I'm working on a project where I must run possibly untrusted JavaScript code. I want to run it in an isolated environment. This looks like a very nice solution as I could spin up a microsandbox and securely run the code. I could even have a pool os live sandboxes so I wouldn't even experience the 200ms starts. Because this is OCI-compatible, I could even provide a whole sandboxed environment…

You might be able to get away with running QuickJS compiled to WebAssembly: https://til.simonwillison.net/npm/self-hosted-quickjs

Re: Microsandbox: Virtual Machines that feel and perform like containers

#132

Post by [deleted] »

Tsarp wrote: post #60
appcypher wrote: post #13

Earlier quoted context omitted.

Thank you! > Can we build our own python sandbox using the sandboxfile spec? Yes and I plan to make that work with the SDK. PS: Multi-stage build is WIP.

Great will join the discord. Is this embeddable? Will it work with a cross platform desktop app(Tauri)?

[deleted]

Re: Microsandbox: Virtual Machines that feel and perform like containers

#133

Post by apitman »

Tsarp wrote: post #60
appcypher wrote: post #13

Earlier quoted context omitted.

Thank you! > Can we build our own python sandbox using the sandboxfile spec? Yes and I plan to make that work with the SDK. PS: Multi-stage build is WIP.

Great will join the discord. Is this embeddable? Will it work with a cross platform desktop app(Tauri)?

An embeddable library that lets you launch Linux VMs that works across Windows, MacOS, and Linux hosts would be incredible.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#134

Post by nulld3v »

appcypher wrote: post #3

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

Cool project. Off topic question: Are the images in the "Use Cases" section in the README from a real app? I like the clean UI design.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#135

Post by spicybright »

appcypher wrote: post #3

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

I like the idea. But when you say "bullet proof" security, there are exploits to break out of VMs that exist. Have you looked into those?

Re: Microsandbox: Virtual Machines that feel and perform like containers

#136

Post by meander_water »

appcypher wrote: post #3

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

Can you explain how this compares to Kata Containers? [0] That also supports OCI to run microVMs. You can also choose different hypervisors such as firecracker to run it on.

[0] https://katacontainers.io/

Re: Microsandbox: Virtual Machines that feel and perform like containers

#137

Post by HumanOstrich »

drewg123 wrote: post #52
drewg123 wrote: post #47

Earlier quoted context omitted.

Without any context in terms of what the VM is doing or what VMM software you use, my best guess is that the OS/VMM are pre-allocating memory for the VM. This might involve paging out other processes' memory, which could take some time. I think task manager would tell you if there is a blip of memory usage and paging activity at the time. And I'm sure windows itself has profilers that can tell you what is happening w…

For some reason I can't reply to your reply. I'd strongly suggest that you profile virtual box. It beats speculation..

I experienced something similar back when Microsoft decided to usurp all hypervisors made for Windows and make Windows itself run as a VM on Hyper-V running as a Type 1 hypervisor on the hardware. That made it so other VMs could only run on Hyper-V alongside Windows or with nested virtualization.

So this meant VMWare, VirtualBox, etc as they were would no longer work on Windows. Microsoft required all of them to switch to using Hyper-V libs behind the scenes to launch Hyper-V VMs and then present them as their own (while hiding them from the Hyper-V UI).

VirtualBox was slow, hot garbage on its own before this happened, but now it's even worse. They didn't optimize their Hyper-V integration as well as VMWare (eventually) did. VMWare is still worse off than it was though since it has to inherit all of Hyper-V's problems behind the scenes.

Hope this brings some clarity.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#138

Post by bjackman »

Veserv wrote: post #95
bjackman wrote: post #91

Earlier quoted context omitted.

You cannot build a secure container runtime (against malicious containers) because underlying it is the Linux kernel. The only way to make Linux containers a meaningful sandbox is to drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value. It's no longer a "generic platform that you can throw any workload onto" but instead a bespoke thing that needs to be tuned and rec…

You cannot build a secure virtualization runtime because underlying it is the VMM. Until you have a secure VMM you are subject to precisely the same class of problems plaguing container runtimes. The only meaningful difference is that Linux containers target partitioning Linux kernel services which is a shared-by-default/default-allow environment that was never designed for and has never achieved meaningful security.…

I see your point but even if your VMM is a zillion lines of C++ with emulated devices there are opportunities to secure it that don't exist with a shared-monolithic-kernel container runtime.

You can create security boundaries around (and even within!) the VMM. You can make it so an escape into the VMM process has only minimal value, by sandboxing the VMM aggressively.

Plus you can absolutely escape the model of C++ emulating devices. Ideally I think VMMs should do almost nothing but manage VF passthroughs. Of course then we shift a lot of the problem onto the inevitably completely broken device firmware but again there are more ways to mitigate that than kernel bugs.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#139

Post by bjackman »

ignoramous wrote: post #101
bjackman wrote: post #91

Earlier quoted context omitted.

You cannot build a secure container runtime (against malicious containers) because underlying it is the Linux kernel. The only way to make Linux containers a meaningful sandbox is to drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value. It's no longer a "generic platform that you can throw any workload onto" but instead a bespoke thing that needs to be tuned and rec…

> ... drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value ... Depends I guess as Android has had quite a bit of success with seccomp-bpf & Android-specific flavour of SELinux [0] > Until we have a properly hardened and memory safe OS ... faster than running MicroVMs on a Linux host. Andy Tanenbaum might say, Micro Kernels would do just as well. [0] https://youtu.be…

> Android

Exactly. Android pulls this off by being extremely constrained. It's dramatically less flexible than an OCI runtime. If you wanna run a random unenlightened workload on it you're probably gonna have a hard time.

> Micro Kernels would do just as well.

Yea this goes in the right direction. In the end a lot of kernel work I look at is basically about trying to retrofit benefits of microkernels onto Linux.

Saying "we should just use an actual microkernel" is a bit like "Russia and Ukraine should just make peace" IMO though.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#140

Post by bjackman »

lillecarl wrote: post #115
ignoramous wrote: post #101

Earlier quoted context omitted.

> ... drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value ... Depends I guess as Android has had quite a bit of success with seccomp-bpf & Android-specific flavour of SELinux [0] > Until we have a properly hardened and memory safe OS ... faster than running MicroVMs on a Linux host. Andy Tanenbaum might say, Micro Kernels would do just as well. [0] https://youtu.be…

You also have gVisor, which runs all syscall through some Go history that's supposedly safe enough for Google.

gVisor uses virtualization
Post reply on HN