3 ms·
That's the approach taken by Google's gVisor (at the cost of I/O and network performance).
by riobard 5y ago
That's the approach taken by Google's gVisor (at the cost of I/O and network performance).
- encryptluks2 5y agogVisor does more than filtering, they basically reimplemented the syscalls in an application kernel. At least with seccomp the performance overhead is minimal.
- remram 5y agoHow does gVisor fair against KVM and other hardware-accelerated VM solutions (firecracker)?
- fsociety 5y agogVisor, for better or for worse, does a whole lot of other things than just seccomp filtering, and it shows in performance tests.
- tptacek 5y agoNo, that's really not at all what gVisor is. gVisor is best thought of as user-mode Linux --- a complete reimplementation of most of the OS kernel. It's not a system call filter; it's something much closer to a VM than to seccomp. gVisor is a very cool codebase. As an illustration of the approach: it includes its own TCP/IP stack; we use it in our command-line dev tool to allow people to SSH to their VMs over WireGuard without having to install WireGuard or obtain privileges to manage WireGuard.