3 ms·

No, gVisor is from Google. They emulate system calls in user-space and use VMs, which increases runtime performance overhead. We use hardware virtualization to

No, gVisor is from Google. They emulate system calls in user-space and use VMs, which increases runtime performance overhead. We use hardware virtualization to directly run containers -- no I/O emulation, no expensive VM exits, scale as needed. Initial comparison with FC/GVisor/Xen here: https://github.com/ashishbijlani/kwarantine https://github.com/ashishbijlani/kwarantine

tptacek 5y ago
It sounds like you just said "yes, but what we're building is faster". The userland Linux emulation is a security benefit, not a liability.
monocasa 5y ago
I'm not sure gvisor requires vm exits. Their first backend used ptrace very similarly to how user mode Linux worked. Minor quip though since ptrace might even be slower than vm exits; your core point stands.
- rkeene2 5y ago
  User Mode Linux is still around and works well. I use it when I need a "fakeroot" without any special privileges on the host. https://rkeene.org/viewer/tmp/fakeroot.sh.htm https://rkeene.org/viewer/tmp/fakeroot.sh.htm
  - mikepurvis 5y ago
    Thanks for the poke on this. I had looked briefly and become frustrated that many of the instructions I found assumed you were a kernel dev and started with compiling everything from source— the Debian-supplied UML binaries seem to work well for my needs though, and do indeed allow doing basic stuff like mounting a disk image so you can run install-grub on it.
    - rkeene2 5y ago
      Hmm, building UML from source is really easy. Here [0] is my process for doing it, as a Makefile. The actual compile step is just one line (line 32): $(MAKE) -C linux-$(KERNEL_VERSION) ARCH=um linux The rest of it sets up the configuration how I want and compiles other dependencies (like slirp) or is for maintenance, like cleaning up, or downloading. This is a rather old version -- newer versions check the checksum and use my HashCache system. [0] https://rkeene.org/viewer/tmp/uml.Makefile.htm https://rkeene.org/viewer/tmp/uml.Makefile.htm

tptacek 5y ago

It sounds like you just said "yes, but what we're building is faster". The userland Linux emulation is a security benefit, not a liability.

monocasa 5y ago

I'm not sure gvisor requires vm exits. Their first backend used ptrace very similarly to how user mode Linux worked. Minor quip though since ptrace might even be slower than vm exits; your core point stands.

rkeene2 5y ago
User Mode Linux is still around and works well. I use it when I need a "fakeroot" without any special privileges on the host. https://rkeene.org/viewer/tmp/fakeroot.sh.htm https://rkeene.org/viewer/tmp/fakeroot.sh.htm
- mikepurvis 5y ago
  Thanks for the poke on this. I had looked briefly and become frustrated that many of the instructions I found assumed you were a kernel dev and started with compiling everything from source— the Debian-supplied UML binaries seem to work well for my needs though, and do indeed allow doing basic stuff like mounting a disk image so you can run install-grub on it.
  - rkeene2 5y ago
    Hmm, building UML from source is really easy. Here [0] is my process for doing it, as a Makefile. The actual compile step is just one line (line 32): $(MAKE) -C linux-$(KERNEL_VERSION) ARCH=um linux The rest of it sets up the configuration how I want and compiles other dependencies (like slirp) or is for maintenance, like cleaning up, or downloading. This is a rather old version -- newer versions check the checksum and use my HashCache system. [0] https://rkeene.org/viewer/tmp/uml.Makefile.htm https://rkeene.org/viewer/tmp/uml.Makefile.htm