3 ms·

Krunvm is extremely easy to use and is packed with some interesting ideas. One of the biggest advantages of this VMM is that programs have access to the networ

Krunvm is extremely easy to use and is packed with some interesting ideas. One of the biggest advantages of this VMM is that programs have access to the network inside the VMM without the admin having to setup complex virtual bridges and so forth in the host in advance or use something like slirp. This is accomplished via TSI (Transparent Socket Impersonation). Basically sockets in the guest are bridged to AF_VSOCK via the use of a patched linux kernel (when you build libkrunfw.so) when communicating outside the VM. See https://www.youtube.com/watch?v=EGV03THGrrw https://www.youtube.com/watch?v=EGV03THGrrw for more info on TSI. My only concern is that TSI is currently not a feature available in Linux. When do the authors plan to upstream this into Linux proper? My understanding is that this was planned in 2021 but it is now 2022...

ignoramous 4y ago
> ...or use something like slirp. Does slirp support protos other than UDP and TCP? Apparently, TSI doesn't: https://github.com/containers/libkrun/blob/1af2e7236d1/README.md#limitations https://github.com/containers/libkrun/blob/1af2e7236d1/READM...
- sidkshatriya 4y ago
  As far as I understand, any protocol that runs over IP (TCP, UDP, ICMP, ...) should be supported by slirp (i.e. slirp4netns) as it sets up a TAP device.
  - sidkshatriya 4y ago
    P.S. Actually slirp4netns also needs to implement a network stack for the protocol in user space so it also depends on what protocols it understands. I wonder if slirp4netns understands anything other than TCP/UDP/ICMP. OTOH I don't think ping (ICMP) is possible with TSI (but maybe I needed to do some other config to make it work).
goombacloud 4y ago
Maybe instead of patching the kernel the "init" process of the VM could set up a seccomp-notify sandbox to handle the socket syscalls in userspace to back them the tcp/udp sockets by a vsock (I think that read/write or sendmsg/recvmsg would work without userspace handling because they get the vsock fd).

ignoramous 4y ago

> ...or use something like slirp. Does slirp support protos other than UDP and TCP? Apparently, TSI doesn't: https://github.com/containers/libkrun/blob/1af2e7236d1/README.md#limitations https://github.com/containers/libkrun/blob/1af2e7236d1/READM...

sidkshatriya 4y ago
As far as I understand, any protocol that runs over IP (TCP, UDP, ICMP, ...) should be supported by slirp (i.e. slirp4netns) as it sets up a TAP device.
- sidkshatriya 4y ago
  P.S. Actually slirp4netns also needs to implement a network stack for the protocol in user space so it also depends on what protocols it understands. I wonder if slirp4netns understands anything other than TCP/UDP/ICMP. OTOH I don't think ping (ICMP) is possible with TSI (but maybe I needed to do some other config to make it work).

goombacloud 4y ago

Maybe instead of patching the kernel the "init" process of the VM could set up a seccomp-notify sandbox to handle the socket syscalls in userspace to back them the tcp/udp sockets by a vsock (I think that read/write or sendmsg/recvmsg would work without userspace handling because they get the vsock fd).