4 ms·
while this looks cool, this is also getting out of hand. we need an operating system that doesn't require all this machinery on top in order to achieve basic en
by a-dub 5y ago
while this looks cool, this is also getting out of hand. we need an operating system that doesn't require all this machinery on top in order to achieve basic encapsulation.
- otabdeveloper4 5y agoAs far as I can tell from 30 seconds of research, this thing just bundles standard Linux syscalls in one package. "This machinery" is just typical Google overengineering, it's not doing anything except acting as middleware. P.S. Yeah, I wish we had a better userspace Linux namespace toolkit instead of Docker.
- spockz 5y agoWhat about podman?
- melony 5y agoSo gVisor for C++?
- a-dub 5y agoi think namespaces are the wrong abstraction. it's a good solution given what exists (posix/linux), but way more hacky than something new with encapsulation of machine code by source being a first class design principle.
- otabdeveloper4 5y agoWrong for what exactly? I just want to run my apps with a separate TCP port namespace :)
- a-dub 5y agothe whole idea that you have to fork process tables, user tables, network tables and filesystems to achieve encapsulation between applications is a product of the old unix security model not being sufficient for what people are actually using these systems for today. so the popularity of containers (namespaces) and the entire ecosystem of tools like this (dating all the way back to chroots and bsd jails) basically says to me that maybe a fresh approach to security features in an operating system would lead to less complexity than what has needed to be built on top of good ol' unix.
- otabdeveloper4 5y agoIf I wanted security then namespaces aren't the tool I would use. (And I don't think they were ever intended as a security feature.)
- a-dub 5y agoyeah i suppose you're right, point still stands. having to chop up all the kernel tables to run little mini systems just to deploy software correctly, along with choosing from a whole host of bolt on capabilities systems and sandboxing technologies makes it seem like the services provided by base unix for modern computing are looking a bit long in the tooth.
- liuliu 5y agoNot sure how to do that from OS perspective without introducing some kind of module concept (either through shared object or some other ways). The SAPI solution seems pretty straightforward to me. Jail the particular library into a sandboxed process and IPC with it transparently. Compatibility will be tricky (especially for libraries that is more complicated). But the solution itself is straightforward and I can see it work.
- a-dub 5y agoyup. we need an operating system and hardware that sandboxes all code and state that runs on it by source, yet still has fast interfaces between units and avoids overt complexity by bolting facilities for this on top.
- Findecanor 5y agoCheck out ELFbac: (http://elfbac.org/ http://elfbac.org/) It extracts "programmer intent" from relations in the ELF format to create memory protection boundaries. It is not exactly sandboxing, but limits what a compromised program module can do.
- pabs3 5y agoThe Hurd could do this sort of thing natively, just load the translators that you want, including a new rootfs if you want.
- taneq 5y agoExactly. As far as I can tell all modern OSes are built on the assumption that users of a machine need protection from each other, rather than that each user needs protection from the third party code that they run.
- iggldiggl 5y ago> user needs protection from the third party code that they run Unfortunately the above then often crosses the line over into "protecting the user from actually accomplishing useful stuff". The file sandboxing approaches I've seen so for e.g. commonly ignore the existence of file formats that don't consist of a single, atomic file.
- jagrsw 5y agoHi, one of the project's co-authors here (SAPI). I think you might want to take a look at https://fuchsia.dev/ https://fuchsia.dev/ - although I haven't worked with it myself so far, the stated goals might be somewhat in line with what you're proposing here.