Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsandbox: Virtual Machines that feel and perform like containers

github.com

Post reply on HN
Print view View original

81–90 of 195 posts

Re: Microsandbox: Virtual Machines that feel and perform like containers

#81

Post by zackmorris »

This is great!

I'd like to see a formal container security grade that works like:

  1) Curate a list of all known (container) exploits
  2) Run each exploit in environments of increasing security like permissions-based, jail, Docker and emulator
  3) The percentage of prevented exploits would be the score from 0-100%
Under this scheme, I'd expect naive attempts at containerization with permissions and jails to score around 0%, while Docker might be above 50% and Microsandbox could potentially reach 100%.

This might satisfy some of our intuition around questions like "why not just use a jail?". Also the containers could run on a site on the open web as honeypots with cash or crypto prizes for pwning them to "prove" which containers achieve 100%.

We might also need to redefine what "secure" means, since exploits like Rowhammer and Spectre may make nearly all conventional and cloud computing insecure. Or maybe it's a moving target, like how 64 bit encryption might have once been considered secure but now we need 128 bit or higher.

Edit: the motivation behind this would be to find a container that's 100% secure without emulation, for performance and cost-savings benefits, as well as gaining insights into how to secure operating systems by containerizing their various services.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#83

Post by mynameisvlad »

dataflow wrote: post #49
drewg123 wrote: post #47

Earlier quoted context omitted.

Without any context in terms of what the VM is doing or what VMM software you use, my best guess is that the OS/VMM are pre-allocating memory for the VM. This might involve paging out other processes' memory, which could take some time. I think task manager would tell you if there is a blip of memory usage and paging activity at the time. And I'm sure windows itself has profilers that can tell you what is happening w…

VirtualBox on Windows, primarily. Though I feel like haven't seen other VMs in the past start up a whole ton faster (maybe a somewhat) (ignoring WSL2). Page files are already disabled, there's plenty of free RAM, and it makes no difference how little RAM the guest is allocated (even if it's 256MB). So no, those are not the issues. VirtualBox itself seems to be doing something slow during that time and I don't know wh…

So the issue is pretty clearly with VirtualBox itself, but you are making it sound like it's an issue with VMs on Windows or in general.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#85

Post by sureglymop »

Always interested when things like this come up.

What like about containers is how quickly I can run something, e.g. `docker run --rm ...` without having to specify disk size, amount of cpu cores, etc. I can then diff the state of the container with the image (and other things) to see what some program did while it ran.

So I basically want the same but instead with small vms to have better sandboxing. Sometimes I also use bwrap but it's not really intended to be used on the command line like that.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#86

Post by pkkkzip »

rbitar wrote: post #84

Looks great and excited to try this out. We’ve also had success using CodeSandbox SDK and E2B, can you share some thoughts on how you compare or future direction? Do you also use Firecracker under the hood?

I can't tell if it uses firecracker but thats my main question too. I'm curious as to whether microsandbox will be maintained and proper auditing will be done.

I welcome alternatives. It's been tough wrestling with Firecracker and OCI images. Kata container is also tough.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#87

Post by srmatto »

sureglymop wrote: post #85

Always interested when things like this come up. What like about containers is how quickly I can run something, e.g. `docker run --rm ...` without having to specify disk size, amount of cpu cores, etc. I can then diff the state of the container with the image (and other things) to see what some program did while it ran. So I basically want the same but instead with small vms to have better sandboxing. Sometimes I als…

It has a YAML config format to declare all of that so you could just do that once, or template it, generate it on the fly, fetch it from remote, or many other methods.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#88

Post by appcypher »

rbitar wrote: post #84

Looks great and excited to try this out. We’ve also had success using CodeSandbox SDK and E2B, can you share some thoughts on how you compare or future direction? Do you also use Firecracker under the hood?

> can you share some thoughts on how you compare or future direction?

Microsandbox does not offer a cloud solution. It is self-hosted, designed to do what E2B does, to make it easier working with microVM-based sandboxes on your local machine whether that is Linux, macOS or Windows (planned) and to seamlessly transition to prod.

> Do you also use Firecracker under the hood?

It uses libkrun.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#89

Post by appcypher »

pkkkzip wrote: post #86
rbitar wrote: post #84

Looks great and excited to try this out. We’ve also had success using CodeSandbox SDK and E2B, can you share some thoughts on how you compare or future direction? Do you also use Firecracker under the hood?

I can't tell if it uses firecracker but thats my main question too. I'm curious as to whether microsandbox will be maintained and proper auditing will be done. I welcome alternatives. It's been tough wrestling with Firecracker and OCI images. Kata container is also tough.

It will be maintained as I will be using it for some other product. And it will be audited in the future but it still early days.

Re: Microsandbox: Virtual Machines that feel and perform like containers

#90

Post by tough »

simonw wrote: post #77
tough wrote: post #36

Earlier quoted context omitted.

sorry i meant to ask simon directly if they require a non-docker solution im working on a wrapper that lets you swap runtimes and my first implementation is mostly a wrapper around docker containers planning to add firecracker next will explore adding microsandbox too cool stuff!

My ideal solution is non-Docker purely because I build software for other people to use. I don't want to have to tell my users "step 1: install Docker" if I can avoid it.

that does make sense, sadly firecracker seems to be mostly relegated to linux for now so there's no good multi-arch story i'm aware of
Post reply on HN