SmartOS provides Zones, and if you need it a KVM instance within a Zone. Hypervisors have their own security issues. They're just programs. That's why there've

SmartOS provides Zones, and if you need it a KVM instance within a Zone. Hypervisors have their own security issues. They're just programs. That's why there've been all the patching over the years for Xen and for KVM. Last year, an independent researcher did find an issue related to Dtrace that Joyent patched. However, the security and engineering that backs Zones is way more than with other kernels. https://www.joyent.com/blog/dtrace-conf-16-wrap-up https://www.joyent.com/blog/dtrace-conf-16-wrap-up DTrace exploitation: http://slides.com/benmurphy/deck#/ http://slides.com/benmurphy/deck#/ http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel-memory-reads-on-illumos/ http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel... https://vimeo.com/173300650 https://vimeo.com/173300650