3 ms·
One has to minimize the exposure of code that can be subject of malicious manipulations. I am not sure that a restricted Linux container with tight filters on s
by fpoling 11y ago
One has to minimize the exposure of code that can be subject of malicious manipulations. I am not sure that a restricted Linux container with tight filters on syscalls that it can use is unconditionally worse than a uni-kernel against Xen.
- pjmlp 11y agoUnikernels can run bare metal, the fact that some of them use Xen is just a matter of saving development hours writing device drivers.
- cyphar 11y agoThe reason they run on a hypervisor is because people need multi-tenancy. Nobody is going to dedicate a whole machine for a single microservice.
- pjmlp 11y agoWho says it is a micro-service? Or do you see things like DNS resolution, databases, file servers and so many other possibilities as plain micro-services? Companies even in 2016, do dedicate whole machines to those services.
- fpoling 11y agoIn that case a bug in unikernel allows to take the whole machine with no option to contains the damage through extra layers of protection.
- pjmlp 11y agoWith the major difference that unikernels are mostly written in memory safe languages with a very thin exploit surface, when compared with the usual set of C based OSes which containers are based of.