Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firecracker MicroVMs

firecracker-microvm.github.io

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Firecracker MicroVMs

#51

Post by moondev »

weikju wrote: post #45
tlrobinson wrote: post #43

Earlier quoted context omitted.

“Are reposts ok?” “If a story has not had significant attention in the last year or so, a small number of reposts is ok. Otherwise we bury reposts as duplicates.” https://news.ycombinator.com/newsfaq.html

I think the question is more along the lines of - was there another news, recently posted, that prompted this post? Like for example if fly.io was announced yesterday, and they said they used Firecracker, then someone would submit this link about Firecracker. So the original poster in this thread was wondering if there was something to that effect. Not decrying something being posted that was not new or already discu…

Would be interesting to see a project that unveils these "chain of influences" for tracking HN engagement on stories or even comments

Re: Firecracker MicroVMs

#52

Post by tptacek »

ignoramous wrote: post #48
rad_gruchalski wrote: post #37

Earlier quoted context omitted.

Directly from Docker image: https://github.com/combust-labs/firebuild#high-level-example . I’m the author.

nb, building from docker is also what fly.io does: https://news.ycombinator.com/item?id=22514017

We're fancier now, and use containerd with LVM.

https://fly.io/blog/docker-without-docker/

Re: Firecracker MicroVMs

#53

Post by tptacek »

m00dy wrote: post #5

anyone knows this can create gpu-enabled microvms ?

This is tricky for Firecracker, both because of security (and the attendant switching costs of keeping exactly one VM connected to a GPU at a time) and because of the Firecracker tenet of supporting oversubscription. They've been talking about it for a couple years. I think they're actually talking about forking off a GPU-capable variant of the project to work around the drama.

Re: Firecracker MicroVMs

#54

Post by notatoad »

tlrobinson wrote: post #43
jrk wrote: post #32

Earlier quoted context omitted.

I think the question is raised because Firecracker was released years ago and has been posted and discussed many times before.

“Are reposts ok?” “If a story has not had significant attention in the last year or so, a small number of reposts is ok. Otherwise we bury reposts as duplicates.” https://news.ycombinator.com/newsfaq.html

as long as we're quoting the rules, "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

assume that the parent's not saying "you shouldn't have posted this, it's old", but rather "i'm interested in firecracker, was there some new development i missed that prompted this submission"... if the answer is no that's okay, but if the answer is yes i'd love to hear about it.

Re: Firecracker MicroVMs

#55

Post by sudhirj »

notatoad wrote: post #54
tlrobinson wrote: post #43

Earlier quoted context omitted.

“Are reposts ok?” “If a story has not had significant attention in the last year or so, a small number of reposts is ok. Otherwise we bury reposts as duplicates.” https://news.ycombinator.com/newsfaq.html

as long as we're quoting the rules, "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." assume that the parent's not saying "you shouldn't have posted this, it's old", but rather "i'm interested in firecracker, was there some new development i missed that prompted this submission"... if the answer is no that's okay, but if th…

Yeah, I’m actually curious if there’s a new major release or feature launch that I missed. I keep tabs on the project, didn’t think anything new suddenly happened.

Re: Firecracker MicroVMs

#57

Post by throwaway984393 »

mastax wrote: post #46

I just deployed a WordPress container on the same host that runs everything else. Makes me a bit uncomfortable. Was thinking about running a VM just as a Docker Swarm worker node, but this post reminded me that these virtualization runtimes exist. Looks like there's a drop-in containerd replacement using firecracker. Kata containers look a bit better supported, though? Or am I too paranoid about container escapes?

What are you worried about them doing? If they take over the app inside the container, they can access your database and seed malware in your users' browsers.

Re: Firecracker MicroVMs

#58

Post by ignoramous »

tptacek wrote: post #52
ignoramous wrote: post #48

Earlier quoted context omitted.

nb, building from docker is also what fly.io does: https://news.ycombinator.com/item?id=22514017

We're fancier now, and use containerd with LVM. https://fly.io/blog/docker-without-docker/

That's super fancy, indeed.

Thanks for these write-ups. They make for a riveting read, even when more than half of it usually is beyond my technical know-how.

Re: Firecracker MicroVMs

#59

Post by gavinray »

rad_gruchalski wrote: post #37
staticassertion wrote: post #2

For those using firecracker, what's your method for building a rootfs?

Directly from Docker image: https://github.com/combust-labs/firebuild#high-level-example . I’m the author.

This is incredibly interesting. Is it alright if I email you with some questions?

Re: Firecracker MicroVMs

#60

Post by staticassertion »

mastax wrote: post #46

I just deployed a WordPress container on the same host that runs everything else. Makes me a bit uncomfortable. Was thinking about running a VM just as a Docker Swarm worker node, but this post reminded me that these virtualization runtimes exist. Looks like there's a drop-in containerd replacement using firecracker. Kata containers look a bit better supported, though? Or am I too paranoid about container escapes?

I don't think you can be too paranoid about container escapes. We actually don't consider containers to be a reliable security boundary - we take it where we can, but if we need real isolation it has to be combined with another approach.
Post reply on HN