3 ms·

It offers a greater degree of sandboxing

by alan-hn 5y ago

rahimnathwani 5y ago
Right, but if I'm only running my own code, I probably don't care about that, right?
- alan-hn 5y ago
  Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way. There's also ignite which works with firecracker: https://github.com/weaveworks/ignite https://github.com/weaveworks/ignite
  - kennethh 5y ago
    Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.
    - alexellisuk 5y ago
      Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box. If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail. Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?
- __turbobrew__ 5y ago
  If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.
  - rahimnathwani 5y ago
    This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...
    - __turbobrew__ 5y ago
      Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs. I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?
- alexellisuk 5y ago
  It depends. In a container, you can't really run docker itself or full K3s for instance. So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want. Of course, we are covering all this in the live-stream, see the link at the end of the repo!
- deleted 5y ago
  [deleted]

It offers a greater degree of sandboxing

rahimnathwani 5y ago

Right, but if I'm only running my own code, I probably don't care about that, right?

alan-hn 5y ago
Depends, is your code being served to the internet? If it is I would definitely consider firecracker but if its just internal it probably won't matter a whole lot. Not sure about the overhead of docker compared with firecracker though, so there may be advantages there either way. There's also ignite which works with firecracker: https://github.com/weaveworks/ignite https://github.com/weaveworks/ignite
- kennethh 5y ago
  Anyone tried Ignite out? Looks like a cool project but I tried to search around but did not fint much about it.
  - alexellisuk 5y ago
    Ignite will launch a microVM in a similar way to my lab, except it has a user experience designed more around Docker's CLI. Great if you just want to use it like a black box. If you're more interested in integrating with Firecracker into your own systems - come to the session because I'm covering this in detail. Weaveworks is now working on a new tool to create K8s clusters where each node is a microVM - Richard Case will be doing a demo of that, and it's super fast. It's for a Telco customer they have, so it's a real use-case, not just shiny tech, so should score extra points, right?
__turbobrew__ 5y ago
If you are importing libraries or 3rd party dependencies you are no longer “running your own code”. Micro VMs help to some extent limiting the fallout of supply chain attacks.
- rahimnathwani 5y ago
  This is a great point. Now I'm wondering whether I should sandbox everything on my desktop...
  - __turbobrew__ 5y ago
    Absolutely! Plan9 had this 30 years ago! OpenBSD also has pledge and unveil to sandbox programs. I think one day we will look back how insane it is that our programs are not isolated. Why does every program I run need access to my SSH keys?
alexellisuk 5y ago
It depends. In a container, you can't really run docker itself or full K3s for instance. So if you have workflows which that you're struggling to make work in a container, without root, a microVM gives you a full environment, where you can do whatever you want. Of course, we are covering all this in the live-stream, see the link at the end of the repo!
deleted 5y ago
[deleted]