4 ms·
Oh dear. Given the audience for this article I'd assume that readers know that this configuration is not suitable for production... but then again it would prob
by gtsteve 8y ago
Oh dear. Given the audience for this article I'd assume that readers know that this configuration is not suitable for production... but then again it would probably be a good idea for the article to state that!
- cremp 8y agoExcept... Amazon itself says that it's been used in production for a while...
- Alupis 8y agoI imagine a competent sysadmin deploying this won't just blindly copy/paste the `chmod 777` command into their terminal... this is likely just a "quick, getting started" sort of thing. Since only the Firecracker user needs read/write access, it would be trivial to limit that to just the Firecracker user or group.
- wstuartcl 8y agoFrom the announcement: Built-In Security: We provide compute security barriers that enable multitenant workloads, and cannot be mistakenly disabled by customers. Customer workloads are simultaneously considered sacred (shall not be touched) and malicious (shall be defended against). Step one, here is a guide that effectively removes all protections on the host system. Win.
- how2cflags 8y agoSo apparently on another page on their site they are using "sudo setfacl -m u:${USER}:rw /dev/kvm" instead. Too confusing. Source: https://aws.amazon.com/blogs/aws/firecracker-lightweight-virtualization-for-serverless-computing/ https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir...
- aliguori 8y agoHi, I work at AWS and before that on KVM since it was a thing. Restricting /dev/kvm these days doesn't make much sense. The interface is designed to be safe for any user. The fact that we started as a character device and not syscalls is just a historical decision.
- gtsteve 8y agoThank you, I have learned something new! I believed it was somewhat similar to having access to the Docker socket and I was always sure to restrict it. Everyone please ignore me.