5 ms·
This implements system calls in user space, intercepting those calls via ptrace (though there is a KVM backend as well). Honestly I don't see an advantage to t
by cpuguy83 9y ago
This implements system calls in user space, intercepting those calls via ptrace (though there is a KVM backend as well).
Honestly I don't see an advantage to this over a stricter seccomp policy, and most definitely slower.
- cpuguy83 9y agoI retract the statement that I don't see the advantage. See https://twitter.com/rauchg/status/991850924057350144 https://twitter.com/rauchg/status/991850924057350144 for why. Basically run `mount` in a gvisor container and run `mount` in a runc container and see the major differences there. Just one example, but as you can see, linux mount namespaces tend to leak lots of mount information. some of it could be cleaned up with additional unmounts after setting up the new root for the container, but knowing what to unmount is not so simple (plus it's just janky AF).