81–85 of 85 posts
Earlier quoted context omitted.
Jails and Zones are inferior to Docker overall, the advantage of Docker is not the isolation technology but the whole workflow of using those containers.
Jails, maybe. Zones, definitely not.
Worth watching is Justin Cormack's recent presentation on unikernels, LinuxKit, eBPF and databases such as SeaStar: The Modern Operating System In 2018 https://www.youtube.com/watch?v=dR2FH8z7L04
Earlier quoted context omitted.
Zones are much more developed than jails, but not quite as flexible as lxc.
I did not know that, I thought lxc was behind zones in terms of features/flexibility.
Earlier quoted context omitted.
Your response confuses me so I must be misunderstanding it. Code is code, all I need is an indirect jump to a pointer somewhere in memory to run the arbitrary code I've installed to compromise the system, so why are unikernels not susceptible to this attack?
"arbitrary code I've installed" How do you do that if there is no facility to load and run code? That's what he's getting at, the binary installed has fixed functionality and has no facilities to do anything but what it's programmed to do. It may have no file system nor almost any other feature that an OS has. It likely supports network ports, but they are unlikely to allow arbitrary code execution becuase again, the…
In my understanding even if I have a piece of code that just loops printing "hello world" and nothing else if it's got a vulnerability that allows me to execute code all bets are off.