Isn't firecracker an AWS tech?
If you're splitting hairs firecracker (aws) is an offshoot of crosvm from chrome/Google which actually was a greenfield vmm :) anyway memory safe virtualization for the win.
Execute Docker Containers as QEMU MicroVMs
61–66 of 66 posts
Re: Execute Docker Containers as QEMU MicroVMs
#62For an even more lightweight approach to running containers in VMs see: https://github.com/containers/krunvm
It's powered by https://github.com/containers/libkrun.
Re: Execute Docker Containers as QEMU MicroVMs
#63Earlier quoted context omitted.
That's the approach taken by Google's gVisor (at the cost of I/O and network performance).
gVisor does more than filtering, they basically reimplemented the syscalls in an application kernel. At least with seccomp the performance overhead is minimal.
How does gVisor fair against KVM and other hardware-accelerated VM solutions (firecracker)?
Re: Execute Docker Containers as QEMU MicroVMs
#64Why not run containers in VMs in containers in VMs? :) Seriously, VMs are hardly as secure as many people want to believe unless you're utilizing enclaves and even that has vulnerabilities. I think a better approach is Seccomp and whatever other filtering makes sense.
A while back I did some looking at FreeBSD jails to try to figure out why they don't have more mindshare (especially when paired with the nigh-superpower-granting ZFS). I came away baffled that they weren't more widely-promoted, compared with Docker and friends. After thinking about it for a while, all I can figure is they're so straightforward to use and well-documented that there's no room to make one's name, or to…
Heretics! Vicitimizing all the Fashionistas! Where would be the fun of endless shiny new things? The thrill of employing l33t google skillz to find just another solution to cut&paste in haste, with no wasted time reading boring old style manuals and documentation. Attention deficit is the hottest shit! Deal with it!
Re: Execute Docker Containers as QEMU MicroVMs
#65Earlier quoted context omitted.
I'm not sure gvisor requires vm exits. Their first backend used ptrace very similarly to how user mode Linux worked. Minor quip though since ptrace might even be slower than vm exits; your core point stands.
User Mode Linux is still around and works well. I use it when I need a "fakeroot" without any special privileges on the host. https://rkeene.org/viewer/tmp/fakeroot.sh.htm
Thanks for the poke on this. I had looked briefly and become frustrated that many of the instructions I found assumed you were a kernel dev and started with compiling everything from source— the Debian-supplied UML binaries seem to work well for my needs though, and do indeed allow doing basic stuff like mounting a disk image so you can run install-grub on it.
Re: Execute Docker Containers as QEMU MicroVMs
#66Earlier quoted context omitted.
User Mode Linux is still around and works well. I use it when I need a "fakeroot" without any special privileges on the host. https://rkeene.org/viewer/tmp/fakeroot.sh.htm
Thanks for the poke on this. I had looked briefly and become frustrated that many of the instructions I found assumed you were a kernel dev and started with compiling everything from source— the Debian-supplied UML binaries seem to work well for my needs though, and do indeed allow doing basic stuff like mounting a disk image so you can run install-grub on it.
Hmm, building UML from source is really easy. Here [0] is my process for doing it, as a Makefile. The actual compile step is just one line (line 32):
$(MAKE) -C linux-$(KERNEL_VERSION) ARCH=um linux
This is a rather old version -- newer versions check the checksum and use my HashCache system.