4 ms·
How so? virtio is pretty small surface area, go out far enough and everything is pure computation.
by nerpderp82 4y ago
How so? virtio is pretty small surface area, go out far enough and everything is pure computation.
- tptacek 4y agoMy argument is empirical. I can name recent LPEs that bypass MAC and sandbox policies; it is not easy to name comparable hypervisor escapes. Shared-kernel container escapes are found so often they're not even all that memorable.
- nerpderp82 4y ago> Shared-kernel container escapes are found so often they're not even all that memorable. Agreed. I realized I inverted your hypervisor comment. Hypervisors have the compact contract that has any reasonable chance at being audited. Container security is basically a screen door.