Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsandbox: Virtual Machines that feel and perform like containers

github.com

Post reply on HN
Print view View original

71–80 of 195 posts

Re: Microsandbox: Virtual Machines that feel and perform like containers

#71

Post by SwiftyBug »

appcypher wrote: post #65
SwiftyBug wrote: post #62

Kind of almost off-topic: I'm working on a project where I must run possibly untrusted JavaScript code. I want to run it in an isolated environment. This looks like a very nice solution as I could spin up a microsandbox and securely run the code. I could even have a pool os live sandboxes so I wouldn't even experience the 200ms starts. Because this is OCI-compatible, I could even provide a whole sandboxed environment…

> Would that be a good use case for this? That is an ideal use case > Are there better alternatives? Created microsandbox because I didn't find any

Awesome. This is really good timing. I'm going to give it a try.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#72

Post by ericb »

SwiftyBug wrote: post #62

Kind of almost off-topic: I'm working on a project where I must run possibly untrusted JavaScript code. I want to run it in an isolated environment. This looks like a very nice solution as I could spin up a microsandbox and securely run the code. I could even have a pool os live sandboxes so I wouldn't even experience the 200ms starts. Because this is OCI-compatible, I could even provide a whole sandboxed environment…

runsc / gVisor is interesting also as the runsc engine can be run from within Docker/Docker Desktop.

gVisor has performance problems, though. Their data shows 1/3rd the throughput vs. docker runtime for concurrent network calls--if that's an issue for your use-case.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#73

Post by ericb »

simonw wrote: post #24
mike_hearn wrote: post #14

Earlier quoted context omitted.

Which platforms do you use?

macOS on my laptop, anything that runs in a container for when I deploy things.

Working gVisor Mac install instructions here.

https://dev.to/rimelek/using-gvisors-container-runtime-in-do...

After this is done, it is:

docker run --rm --runtime=runsc hello-world

Re: Microsandbox: Virtual Machines that feel and perform like containers

#75

Post by appcypher »

nqzero wrote: post #68
appcypher wrote: post #3

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

i'm on a mid-level laptop, at times with slow or expensive internet, running ubuntu. i want to be able to run nominally-isolated "copies" of my laptop at near-native speed 1. each one should have it's own network config, eg so i can use wireguard or a vpn 2. gui pass-through to the host, eg wayland, for trusted tools, eg firefox, zoom or citrix 3. needs to be lightweight. eg gnome-boxes is dead simple to setup and ru…

> 1. each one should have it's own network config, eg so i can use wireguard or a vpn

This is possible right now but the networking is not where I want it to be yet. It uses libkrun's default TSI impl; performant and simplifies setup but can be inflexible. I plan to implement an alternative user-space networking stack soon.

> 2. gui pass-through to the host, eg wayland, for trusted tools, eg firefox, zoom or citrix

We don't have GUI passthrough. VNC?

> 3. needs to be lightweight. eg gnome-boxes is dead simple to setup and run and it works, but the resource usage was noticeably higher than native

It is lightweight in the sense that it is not a full vm

> 4. optional - more security is better (ie, i might run semi-untrusted software in one of them, eg from a github repo or npm), but i'm not expecting miracles and accept that escape is possible

The security guarantees are similar to what typical VMs support. It is hardware-virtualized so I would say you should be fine.

> 5. optional - sharing disk with the host via COW would be nice, so i'd only need to install the env-specific packages, not the full OS

Yeah. It uses virtio-fs and has overlayfs on top of that for COW.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#76

Post by appcypher »

hugs wrote: post #57
appcypher wrote: post #31

Earlier quoted context omitted.

Yes! With the `scope` property. https://github.com/microsandbox/microsandbox/blob/0c13fc27ab...

thanks! have an example on how to use that in a sandboxfile? (also, this project is really cool. great work!)

Yeah. I need to fix that in the docs!

Re: Microsandbox: Virtual Machines that feel and perform like containers

#77

Post by simonw »

tough wrote: post #36
appcypher wrote: post #20

Earlier quoted context omitted.

I don't understand what you mean? Can you clarify?

sorry i meant to ask simon directly if they require a non-docker solution im working on a wrapper that lets you swap runtimes and my first implementation is mostly a wrapper around docker containers planning to add firecracker next will explore adding microsandbox too cool stuff!

My ideal solution is non-Docker purely because I build software for other people to use. I don't want to have to tell my users "step 1: install Docker" if I can avoid it.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#78

Post by appcypher »

elwebmaster wrote: post #74

One topic I am not finding anything about is networking. Can these microsandbox instances listen on ports? How is the port forwarding configured? Can they access the internet or any resources on the host?

They can. I need to improve the doc. Working on that right now

Re: Microsandbox: Virtual Machines that feel and perform like containers

#79

Post by simonw »

tough wrote: post #34
simonw wrote: post #24

Earlier quoted context omitted.

macOS on my laptop, anything that runs in a container for when I deploy things.

I had luck using ALVM which users Apple Hypervisor framework while exploring linux micro-vm's in macos fwiw https://github.com/mathetake/alvm

That looks really cool, but it's missing the one feature I want most from anything that runs a sandbox (or any security-related software): I need something which a billion dollar company with a professional security team is running in production on a daily basis.

So much of the solutions to this stuff I see come from a GitHub repo with a few dozen commits and often a README that says "do not rely on this software yet".

Definitely going to play with it a bit though, I love the idea of hooking into Apple's Hypervisor.framework (which absolutely fits my billion-dollar-company requirement.)

Re: Microsandbox: Virtual Machines that feel and perform like containers

#80

Post by appcypher »

wolfhumble wrote: post #64
appcypher wrote: post #3

Thanks for sharing! I'm the creator of microsandbox. If there is anything you need to know about the project, let me know. This project is meant to make creating microvms from your machine as easy as using Docker containers. Ask me anything.

Can you use Microsandbox for everything you can use Docker for, or are there cases where containers make more sense? Congratulations on the launch!

We want microsandbox to be usable for everything you can with Docker.

That said, hosting microVMs require dedicated hardware or VMs with nested virt support. Containers don’t have that problem.

Post reply on HN