4 ms·

Xen is not a container, compare it to qemu/KVM more. I would not host untrusted customers in docker containers, LXC, but I would in Xen HVM any day.

• NullPrefix 6y ago
  >I would [..] host untrusted customers in [...] Xen HVM any day. Intel doesn't recommend running untrusted code even in a separate VM, according to their official explanation of Spectre/Meltdown. At least we can do it on RPi now.
  • pengaru 6y ago
    > At least we can do it on RPi now. Couldn't we already do it on an RPi with linux/kvm+qemu?
  • SturgeonsLaw 6y ago
    Not to mention if you give the untrusted VM a network interface then it can be the equivalent of plugging an untrusted computer into your network
    • emteycz 6y ago
      Huh? You can't make a VLAN or use a firewall?
  • s1dev 6y ago
    The A72 has speculative execution so I don’t think that’s strictly speaking true