3 ms·
Some options already listed in replies to this comment, but you might consider gVisor as well: https://gvisor.dev/ https://gvisor.dev/ gVisor is kind of Linux
by jrockway 4y ago
Some options already listed in replies to this comment, but you might consider gVisor as well: https://gvisor.dev/ https://gvisor.dev/
gVisor is kind of Linux running in Linux. More insolation than containers; less overhead than VMs (but less isolation, of course).
- jmillikin 4y ago> less overhead than VMs Make sure to benchmark your workload first -- gVisor's I/O subsystem is a lot slower than the Linux kernel's, so a VM can be materially faster if you're doing a lot of filesystem operations or file I/O. One of the systems I built at a former employer supported both gVisor and Firecracker for isolation, and the gVisor version was 10-50x slower for a specific class of workload that did ~millions of stat() calls at startup.
- jrockway 4y agoYup, very good point. I think that something like gVisor should probably be your second choice after you've eliminated VMs for whatever reason.
- deleted 4y ago[deleted]