2 ms·

Thanks Kenton. > Firecracker runs attacker-provided native code directly on hardware, which means that hardware itself becomes an attack surface, one that is q

Thanks Kenton. > Firecracker runs attacker-provided native code directly on hardware, which means that hardware itself becomes an attack surface, one that is quite wide, not fully documented, and very hard to patch if problems arise. It's much easier to work around hardware bugs... I see your point. I mean, Google wouldn't put as much effort as they are on gVisor if KVMs were the best possible answer.

kentonv 6y ago
To be fair, gVisor also runs native code directly on hardware. Any modern VM-based system is still depending on the CPU to enforce boundaries. A big CPU bug could ruin that at any time. (Spectre has been pretty bad, but not quite a showstopper...)