3 ms·
My simplified version: A container is a way of sharing the resources of a kernel, with some resource isolation. A unikernel is a way of sharing the resources of
by crb 11y ago
My simplified version: A container is a way of sharing the resources of a kernel, with some resource isolation. A unikernel is a way of sharing the resources of a hypervisor.
There are pros and cons to each: a container lets you run other things on the same kernel, and introspect the running process (as well as do interception of things like sysdig does.) However, root-on-container generally means root-on-all-containers. So we use VMs to host containers in.
x86 is much smaller in terms of instruction set to a Linux kernel, there are historically fewer vulnerabilities, many fewer LoC, etc. The unikernel compiles your OS and libs together, meaning you can share a hypervisor - which is good for security. You lose some of the convenience of management of containers in order to get this.
- amirmc 11y ago> "You lose some of the convenience of management of containers in order to get this." Not necessarily... http://unikernel.org/blog/2015/unikernels-meet-docker/ http://unikernel.org/blog/2015/unikernels-meet-docker/
- crb 11y agoYou lose the ability to monitor by introspection: all you know is "this VM is using X CPU and X RAM", you can't look into what it's doing inside the VM. It's the same as a VM without an agent, today. This can be considered a security win and a usability loss.
- musha68k 11y agoDoes the xen hypervisor offer same-page merging? I believe kvm as well as lxc/cgroups do, at least to some extent and in their own idiosyncratic ways. From the point of view of a former sysadmin and current "private cloud" enthusiast that's a crucial question that likely leads to intricate discussions on security as well.