Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kata Containers – The speed of containers, the security of VMs

katacontainers.io

Post reply on HN
Print view View original

41–50 of 76 posts

Re: Kata Containers – The speed of containers, the security of VMs

#41

Post by hacknat »

reacharavindh wrote: post #2

Impressive backing by the big name companies. The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD? On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I alwa…

At the Kubecon demo yesterday they cracked a joke about promising to support more architectures. They seem to sincerely want to, which is why they donated the project to OpenStack. Honestly it seems really cool, the spin up time is damn impressive.

Re: Kata Containers – The speed of containers, the security of VMs

#43

Post by GalacticDomin8r »

benmmurphy wrote: post #39
jchw wrote: post #31

Earlier quoted context omitted.

Sheesh, no need to get so emotional about it. I said instances of breaking out, not instances of jail exploits. I don't know of any jail-specific exploits. But when we say "elevated privileges" are we talking root inside of a jail? Because if that breaks jails, then a large class of Docker exploits also wouldn't classify as 'exploits' under that criteria. One of the biggest problems with Linux namespaces is the band-…

i believe there was an exploit by another team which used badiret. which is pretty hilarious because badiret has been patched ages ago but FreeBSD never told anyone they fixed it.

You mean like this?

https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21...

Re: Kata Containers – The speed of containers, the security of VMs

#44

Post by qaq »

benmmurphy wrote: post #40
qaq wrote: post #30

Earlier quoted context omitted.

"containers are not secure, anywhere" Zones are very secure although you might or might not consider them "containers".

Zones have the same problem that linux containers have which is a massive attack surface in the form of a kernel. And if you think zones are secure: Which OS do you think had more kernel exploits that could be used to escape container/zone in the last 2 years? I think the answer is much closer than you might think.

I am not tracking closely to be honest since I have not being working with Illumos based distros for 5 years +/- when we were using omniOS I do not remember things being too bad. Not sure what % of vuln. are Oracle Solaris specific given that majority of orig. SUN eng. left long time ago Illumos might be in much better shape vs Solaris.

Re: Kata Containers – The speed of containers, the security of VMs

#45

Post by benmmurphy »

GalacticDomin8r wrote: post #43
benmmurphy wrote: post #39

Earlier quoted context omitted.

i believe there was an exploit by another team which used badiret. which is pretty hilarious because badiret has been patched ages ago but FreeBSD never told anyone they fixed it.

You mean like this? https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21...

yeah it was fixed in 2014 and there wasn't an advisory until 2015. https://reviews.freebsd.org/rS275833

hn discussion: https://news.ycombinator.com/item?id=10093862

Re: Kata Containers – The speed of containers, the security of VMs

#46

Post by mugsie »

reacharavindh wrote: post #2

Impressive backing by the big name companies. The idea of treating containers as secure and isolated as VMs is enticing for non-ephemeral services. Are these strictly tuned to exploit intel Hardware features or would they consider supporting the equivalent features in say AMD? On the other hand, isn't this the realm of mainline distributions like RHEL, Debian and the like? To support such isolation facilities. I alwa…

Separate projects like this is how a lot of these "RHEL Enterprise $FOO" are actually made.

RedHat / Suse / Ubuntu / $Vendor take the upstream project, tidy it a bit, package it, get it integrated in their ecosystem, and add an easy installer.

Having it in a vendor neutral foundation means that all the vendors can colaborate, and not have one group with a massive advantage or complete control over a roadmap.

Re: Kata Containers – The speed of containers, the security of VMs

#47

Post by mugsie »

jeremyjh wrote: post #28

They don't seem to have written any code yet. [1] So what we have at this point is a marketing website about their ambition and goals? [1] https://github.com/kata-containers/runtimes

There does seem to be a fair bit left to write (or clean up and open source from Hyper.sh and Intel)

e.g. the entire testing repo is empty

I would suggest we are looking at a conference driven development release

Re: Kata Containers – The speed of containers, the security of VMs

#48

Post by perlgeek »

paulfurtado wrote: post #34
perlgeek wrote: post #9

One thing that isn't mentioned on front page at least is the management aspect. Docker became popular because it was pretty easy to use, and to publish and reuse existing containers. Whatever competes with it only stands a chance if it can either reuse the existing container ecosystem, or offer something roughly as good.

Sat through the talk at kubecon yesterday - an important goal of theirs is to not compete with the docker. They said it was compatible with docker, containerd, and cri-o. I believe with docker, it sits at the runc level, so to the end user, you're using docker in the standard fashion, but the underlying isolation mechanism is different. They also said it can be chosen per container so different containers on the same…

That makes a lot of sense, and probably the road that makes adoption easiest. Thanks!

Re: Kata Containers – The speed of containers, the security of VMs

#50

Post by X86BSD »

benmmurphy wrote: post #38
X86BSD wrote: post #29

Earlier quoted context omitted.

This is the most blatant and clearly incorrect... FUD?..lie?... I have ever heard to date about jails. Jails are secure. As are SmartOS zones. Whoever you heard that there are “many instances of breaking out of a jail” from is full of sh47. And you would be wise to never listen to them ever again. No really, EVER. And no, breaking the ps4 was not a jail exploit. The attacker already had elevated privileges. So you wo…

yeah there are probably not many 'jail' exploits specifically targeted for getting out of jail/exploiting jail primitives. but people just use normal kernel exploits to get out of jail/zones. i would say jails/zones are about as secure as linux containers. ie: about as secure as the linux kernel is.

And you would be wrong.
Post reply on HN