Live data from Hacker News

Unfashionably secure: why we use isolated VMs

blog.thinkst.com

81–90 of 256 posts

Re: Unfashionably secure: why we use isolated VMs

#81
post #6

Earlier quoted context omitted.

For me it's about the ROAC property (Runs On Any Computer). I prefer working with stuff that I can run. Running software is live software, working software, loved software. Software that only works in weird places is bad, at least for me. Docker is pretty crappy in most respects, but it has the ROAC going for it. I would love to have a "docker-like thing" (with ROAC) that used VMs not containers (or some other isolat…

Vagrant / Packer?

With all the mind share that terraform gets you would thing vagrant would at least be known but alas

Re: Unfashionably secure: why we use isolated VMs

#82
One thing I wasn't able to grok from the article is orchestration of VMs. Are they using AWS to manage the VM lifecycles, restart them, etc?

Last time I looked into this for on-prem the solutions seemed very enterprise, pay the big bux, focused. Not a lot in the OSS space. What do people use for on-prem VM orchestration that is OSS?

Re: Unfashionably secure: why we use isolated VMs

#83
post #27

Earlier quoted context omitted.

Would you say approaches like gvisor or nabla containers provide more/enough evolution on the security front? Or is there something new on the horizon that excites you more as a prospect?

GVisor basically works by intercepting all Linux syscalls, and emulating a good chunk of the Linux kernel in userspace code. In theory this allows lowering the overhead per VM, and more fine-grained introspection and rate limiting / balancing across VMs, because not every VM needs to run it's own kernel that only interacts with the environment through hardware interfaces. Interaction happens through the Linux syscall…

I actually wonder how much "overhead" a VM actually has. i.e. a linux kernel that doesn't do anything (say perhaps just boots to an init that mounts proc and every n seconds read in/prints out /proc/meminfo) how much memory would the kernel actually be using?

So if processes in gvisor map to processes on the underlying kernel, I'd agree it gives one a better ability to introspect (at least in an easy manner).

It gives me an idea that I'd think would be interesting (I think this has been done, but it escapes me where), to have a tool that is external to the VM (runs on the hypervisor host) that essentially has "read only" access to the kernel running in the VM to provide visibility into what's running on the machine without an agent running within the VM itself. i.e. something that knows where the processes list is, and can walk it to enumerate what's running on the system.

I can imagine the difficulties in implementing such a thing (especially on a multi cpu VM), where even if you could snapshot the kernel memory state efficiently, it be difficult to do it in a manner that provided a "safe/consistent" view. It might be interesting if the kernel itself could make a hypercall into the hypervisor at points of consistency (say when finished making an update and about to unlock the resource) to tell the tool when the data can be collected.

Re: Unfashionably secure: why we use isolated VMs

#84

Earlier quoted context omitted.

What do you think of Nix/NixOS?

But that comes _after_ you have chosen VMs over Containers yes? If you are using VMs, I think NixOs/Guix is a good choice. Reproducible builds, Immutable OS, Immutable binaries and Dead easy rollback. It still looks somewhat futuristic. Hopefully gets traction.

Nix is actually a really nice tool for building docker images: https://xeiaso.net/talks/2024/nix-docker-build/

Re: Unfashionably secure: why we use isolated VMs

#85

Earlier quoted context omitted.

Solves dependency version hell also

Solves it in the same sense that it's a giant lockfile. It doesn't solve the other half where updates can horribly break your system and you run into transitive version clashes.

It solves it in the sense that it empowers the devs to update their dependencies on their own time and ops can update the underlying infrastructure fearlessly. It turned a coordination problem into a non-problem.

Re: Unfashionably secure: why we use isolated VMs

#86
post #27

Earlier quoted context omitted.

Would you say approaches like gvisor or nabla containers provide more/enough evolution on the security front? Or is there something new on the horizon that excites you more as a prospect?

been out of the space for a bit (though interviewing again, so might get back into it), gvisor at least as the "userspace" hypervisor, seemed to provide minimal value vs modern hypervisor systems with low overhead / quick boot VMs (ala firecracker). With that said, I only looked at it years ago, so I could very well be out of date on it. Wasn't aware of Nabla, but they seem to be going with the unikernel approach (ba…

Modern gVisor uses KVM, not ptrace, for this reason.

Re: Unfashionably secure: why we use isolated VMs

#87
post #33

Earlier quoted context omitted.

[flagged]

Show me a recent escape from VT-d and then you will have a point.

VT-x. You should get the name of the technology right before defending it. VT-d is the I/O virtualization technology.

When did it become customary to defend people making claims of security instead of laughing in their face even though history shows them such claims to be a endless clown parade?

How about you present the extraordinary evidence needed to support the extraordinary claim that there are no vulnerabilities? I will accept simple forms of proof such as a formal proof of correctness or a unclaimed 10 M$ bug bounty that has never been claimed.

Re: Unfashionably secure: why we use isolated VMs

#88

Earlier quoted context omitted.

Vagrant / Packer?

With all the mind share that terraform gets you would thing vagrant would at least be known but alas

Somebody educate me about the problem Packer would solve for you in 2024?

Re: Unfashionably secure: why we use isolated VMs

#89
post #54
post #33

Earlier quoted context omitted.

[flagged]

Hah, I was going to post the same quote when I read the parent comment. Glad to see I'm not the only grump who remembers TDR quotes. But he's right. And with the endless stream of leaky CPUs and memory (spectre, rowhammer, etc) he's even more right now than he was 17 years ago. There are all kinds of things being done to mitigate multi-tenant security risks in the Confidential Computing space (with Trusted Execution…

Microarchitectural attacks are an even bigger problem for shared-kernel multitenant systems!

Re: Unfashionably secure: why we use isolated VMs

#90
post #63
post #9

Earlier quoted context omitted.

Clear Containers/Kata Containers/firecracker VMs showed that there isn't really a dichotomy here. Why we aren't all using HW assisted containers is a mystery.

It's not at all mysterious: to run hardware-virtualized containers, you need your compute hosted on a platform that will allow KVM. That's a small, expensive, tenuously available subset of AWS, which is by far the dominant compute platform.

So… Lambda, Fargate, and EC2. The only thing you can't really do this with is EKS.

Like Firecracker was made by AWS to run containers on their global scale KVM, EC2.

Post reply on HN