Whats the difference between unikernels and kata containers?
Kata Containers – The speed of containers, the security of VMs
21–30 of 76 posts
Re: Kata Containers – The speed of containers, the security of VMs
#22It's kind of interesting that it's only in the Linux world that containers cannot be thought of as isolated or secure. Seeing it from a jails and zones perspective, rather sad, actually :)
FreeBSD jails are known to not be silver bullets. I've heard many instances of breaking out of a FreeBSD jail.
Generally, treating any OS-level technology as a silver bullet is a huge mistake. Any serious developer would make multiple levels of security that _should_ be sound.
Re: Kata Containers – The speed of containers, the security of VMs
#23Earlier quoted context omitted.
> Kata Containers combines technology from Intel® Clear Containers and Hyper runV but I can't find a mention of Hyper-V anywhere (which doesn't mean there was no inspiration). Maybe you confused Hyper runv and Hyper-V here (the naming certainly doesn't help)?
runV is a oci compatible drop in replacement for runC that can execute containers on a number of backend virtualisation environments, including Hyper-V and KVM
That's coincidence, though. runV wasn't inspired by Hyper-V.
Re: Kata Containers – The speed of containers, the security of VMs
#24One thing that isn't mentioned on front page at least is the management aspect. Docker became popular because it was pretty easy to use, and to publish and reuse existing containers. Whatever competes with it only stands a chance if it can either reuse the existing container ecosystem, or offer something roughly as good.
If it's using Hyper runV, my guess is that their intent is to be compatible with OCI and Docker.
Re: Kata Containers – The speed of containers, the security of VMs
#25Earlier quoted context omitted.
Funny, I never thought about it that way. Namespaced processes being a linux kernel feature in the first place. That's where the whole container thing CAME from in the first place. It's only because the Windows and OSX kernels _don't_ support namespacing, that we have to run docker et al inside a virtual machine on those environments. It is not the container implementation, but the virtual machine, which makes contai…
> containers are not secure, anywhere. Virtual machines are. Can you (or someone else) ELI5 what makes containers insecure? Not a low level Linux or security expert.
I'm sure there's more, but the most obvious is that they share one running kernel. So, one kernel exploit in one container means you now have all the running containers.
Re: Kata Containers – The speed of containers, the security of VMs
#26Whats the difference between unikernels and kata containers?
Different approaches to isolation. A kata container is using Clear Linux to load a feature-complete Linux kernel into tiny VMs (disclaimer: I do not know exactly how it's different from any other VM,) a unikernel is a small bare-metal "library" that gives you minimal OS-like functions to put in a hypervisor to run your application. Unikernels are still more minimal, I'd guess.
Re: Kata Containers – The speed of containers, the security of VMs
#27The British Indian Ocean territory really is becoming a tech hub.
So there is no country called "Input/Output", what a bummer.
Re: Kata Containers – The speed of containers, the security of VMs
#28They don't seem to have written any code yet. [1] So what we have at this point is a marketing website about their ambition and goals?
Re: Kata Containers – The speed of containers, the security of VMs
#29It's kind of interesting that it's only in the Linux world that containers cannot be thought of as isolated or secure. Seeing it from a jails and zones perspective, rather sad, actually :)
FreeBSD jails are known to not be silver bullets. I've heard many instances of breaking out of a FreeBSD jail. Generally, treating any OS-level technology as a silver bullet is a huge mistake. Any serious developer would make multiple levels of security that _should_ be sound.
This is the most blatant and clearly incorrect... FUD?..lie?... I have ever heard to date about jails.
Jails are secure. As are SmartOS zones. Whoever you heard that there are “many instances of breaking out of a jail” from is full of sh47. And you would be wise to never listen to them ever again. No really, EVER.
And no, breaking the ps4 was not a jail exploit. The attacker already had elevated privileges. So you would be sunk no matter what.
Re: Kata Containers – The speed of containers, the security of VMs
#30It's kind of interesting that it's only in the Linux world that containers cannot be thought of as isolated or secure. Seeing it from a jails and zones perspective, rather sad, actually :)
Funny, I never thought about it that way. Namespaced processes being a linux kernel feature in the first place. That's where the whole container thing CAME from in the first place. It's only because the Windows and OSX kernels _don't_ support namespacing, that we have to run docker et al inside a virtual machine on those environments. It is not the container implementation, but the virtual machine, which makes contai…
"containers are not secure, anywhere" Zones are very secure although you might or might not consider them "containers".