Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kata Containers – The speed of containers, the security of VMs

katacontainers.io

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Kata Containers – The speed of containers, the security of VMs

#31

Post by jchw »

X86BSD wrote: post #29
jchw wrote: post #22

Earlier quoted context omitted.

FreeBSD jails are known to not be silver bullets. I've heard many instances of breaking out of a FreeBSD jail. Generally, treating any OS-level technology as a silver bullet is a huge mistake. Any serious developer would make multiple levels of security that _should_ be sound.

This is the most blatant and clearly incorrect... FUD?..lie?... I have ever heard to date about jails. Jails are secure. As are SmartOS zones. Whoever you heard that there are “many instances of breaking out of a jail” from is full of sh47. And you would be wise to never listen to them ever again. No really, EVER. And no, breaking the ps4 was not a jail exploit. The attacker already had elevated privileges. So you wo…

Sheesh, no need to get so emotional about it. I said instances of breaking out, not instances of jail exploits. I don't know of any jail-specific exploits.

But when we say "elevated privileges" are we talking root inside of a jail? Because if that breaks jails, then a large class of Docker exploits also wouldn't classify as 'exploits' under that criteria. One of the biggest problems with Linux namespaces is the band-aid put over root, via capabilities.

As far as I know, though, the PS4 exploit was more Sony's fault. IIRC, they broke out of the jail by exploiting custom syscalls not in stock FreeBSD. Bugs in syscalls in FreeBSD aren't unheard of though, even if less commonly found than Linux.

My entire point is that good security implies not treating any solution as a panacea, lest you find yourself in a digital Titanic scenario. Multiple layers of solid security beats one layer of solid security.

Re: Kata Containers – The speed of containers, the security of VMs

#32

Post by devonkim »

reacharavindh wrote: post #10
FooBarWidget wrote: post #6

Earlier quoted context omitted.

> The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services Are you saying that security and isolation is not enticing for ephemeral services? I know that an ephemeral container is reset after a restart but I think that it's a bit naive to think that that is a good enough replacement for true isolation.

> Are you saying that security and isolation is not enticing for ephemeral services? Didn't mean to imply the reverse logic of my statement. I believe Linux Containers (and hence Docker) depend only on Kernel namespaces to provide isolation. In my admittedly naive eyes, they were not good enough/mature to replace my KVM VMs yet. Too much to trade off for little convenience/performance. However, if Linux containers ma…

Sounds like you are looking for something closer to LXD or perhaps Rkt.

Re: Kata Containers – The speed of containers, the security of VMs

#33

Post by ams6110 »

jchw wrote: post #26
jeshwanth wrote: post #21

Whats the difference between unikernels and kata containers?

Different approaches to isolation. A kata container is using Clear Linux to load a feature-complete Linux kernel into tiny VMs (disclaimer: I do not know exactly how it's different from any other VM,) a unikernel is a small bare-metal "library" that gives you minimal OS-like functions to put in a hypervisor to run your application. Unikernels are still more minimal, I'd guess.

Here's a recent paper about the unikernel approach

http://cnp.neclab.eu/projects/lightvm/lightvm.pdf

Re: Kata Containers – The speed of containers, the security of VMs

#34

Post by paulfurtado »

perlgeek wrote: post #9

One thing that isn't mentioned on front page at least is the management aspect. Docker became popular because it was pretty easy to use, and to publish and reuse existing containers. Whatever competes with it only stands a chance if it can either reuse the existing container ecosystem, or offer something roughly as good.

Sat through the talk at kubecon yesterday - an important goal of theirs is to not compete with the docker. They said it was compatible with docker, containerd, and cri-o. I believe with docker, it sits at the runc level, so to the end user, you're using docker in the standard fashion, but the underlying isolation mechanism is different. They also said it can be chosen per container so different containers on the same host can use different isolation mechanisms

Re: Kata Containers – The speed of containers, the security of VMs

#35

Post by paulfurtado »

jeremyjh wrote: post #28

They don't seem to have written any code yet. [1] So what we have at this point is a marketing website about their ambition and goals? [1] https://github.com/kata-containers/runtimes

The code comes from Intel's Clear Containers and hyper. The interesting bit is that the tech is now part of the openstack foundation, under the name Kata Containers. At Kubecon yesterday, they did a demo, showing a fork bomb taking out a container, but not the host. It actually seems nearly ready to use.

Re: Kata Containers – The speed of containers, the security of VMs

#36

Post by GalacticDomin8r »

jchw wrote: post #22
chungy wrote: post #12

It's kind of interesting that it's only in the Linux world that containers cannot be thought of as isolated or secure. Seeing it from a jails and zones perspective, rather sad, actually :)

FreeBSD jails are known to not be silver bullets. I've heard many instances of breaking out of a FreeBSD jail. Generally, treating any OS-level technology as a silver bullet is a huge mistake. Any serious developer would make multiple levels of security that _should_ be sound.

That's quite true. Any serious FreeBSD will readily acknowledge such(eg https://www.freebsd.org/doc/handbook/jails.html), but the project does try to default to sensible security defaults for it's containers eg no raw sockets.

While not applicable to FreeBSD alone, this polemic thread:

https://marc.info/?l=openbsd-misc&m=119318909016582

is a pretty accurate description of container level security and not much has changed. Stuff built on a foundation is always subject to the foundation's qualities.

Re: Kata Containers – The speed of containers, the security of VMs

#37

Post by tecleandor »

jeremyjh wrote: post #28

They don't seem to have written any code yet. [1] So what we have at this point is a marketing website about their ambition and goals? [1] https://github.com/kata-containers/runtimes

It is comprised by many parts that, already, have seen development as:

Kata Agent: https://github.com/kata-containers/agent

Kata Shim: https://github.com/kata-containers/shim

Kata Proxy: https://github.com/kata-containers/proxy

KSM Throttler: https://github.com/kata-containers/ksm-throttler

And some forks to provide for their necessities, I suppose, as:

Linux Kernel: https://github.com/kata-containers/linux

QEMU: https://github.com/kata-containers/qemu

Re: Kata Containers – The speed of containers, the security of VMs

#38

Post by benmmurphy »

X86BSD wrote: post #29
jchw wrote: post #22

Earlier quoted context omitted.

FreeBSD jails are known to not be silver bullets. I've heard many instances of breaking out of a FreeBSD jail. Generally, treating any OS-level technology as a silver bullet is a huge mistake. Any serious developer would make multiple levels of security that _should_ be sound.

This is the most blatant and clearly incorrect... FUD?..lie?... I have ever heard to date about jails. Jails are secure. As are SmartOS zones. Whoever you heard that there are “many instances of breaking out of a jail” from is full of sh47. And you would be wise to never listen to them ever again. No really, EVER. And no, breaking the ps4 was not a jail exploit. The attacker already had elevated privileges. So you wo…

yeah there are probably not many 'jail' exploits specifically targeted for getting out of jail/exploiting jail primitives. but people just use normal kernel exploits to get out of jail/zones. i would say jails/zones are about as secure as linux containers. ie: about as secure as the linux kernel is.

Re: Kata Containers – The speed of containers, the security of VMs

#39

Post by benmmurphy »

jchw wrote: post #31
X86BSD wrote: post #29

Earlier quoted context omitted.

This is the most blatant and clearly incorrect... FUD?..lie?... I have ever heard to date about jails. Jails are secure. As are SmartOS zones. Whoever you heard that there are “many instances of breaking out of a jail” from is full of sh47. And you would be wise to never listen to them ever again. No really, EVER. And no, breaking the ps4 was not a jail exploit. The attacker already had elevated privileges. So you wo…

Sheesh, no need to get so emotional about it. I said instances of breaking out, not instances of jail exploits. I don't know of any jail-specific exploits. But when we say "elevated privileges" are we talking root inside of a jail? Because if that breaks jails, then a large class of Docker exploits also wouldn't classify as 'exploits' under that criteria. One of the biggest problems with Linux namespaces is the band-…

i believe there was an exploit by another team which used badiret. which is pretty hilarious because badiret has been patched ages ago but FreeBSD never told anyone they fixed it.

Re: Kata Containers – The speed of containers, the security of VMs

#40

Post by benmmurphy »

qaq wrote: post #30
ohthehugemanate wrote: post #18

Earlier quoted context omitted.

Funny, I never thought about it that way. Namespaced processes being a linux kernel feature in the first place. That's where the whole container thing CAME from in the first place. It's only because the Windows and OSX kernels _don't_ support namespacing, that we have to run docker et al inside a virtual machine on those environments. It is not the container implementation, but the virtual machine, which makes contai…

"containers are not secure, anywhere" Zones are very secure although you might or might not consider them "containers".

Zones have the same problem that linux containers have which is a massive attack surface in the form of a kernel. And if you think zones are secure: Which OS do you think had more kernel exploits that could be used to escape container/zone in the last 2 years? I think the answer is much closer than you might think.
Post reply on HN