4 ms·
With eBPF there is really not much to argue about in security space. You can do everything. New toolset for containers covers pretty much every possible use-c
by pojzon 4y ago
With eBPF there is really not much to argue about in security space.
You can do everything.
New toolset for containers covers pretty much every possible use-case you could even imagine.
The trend will continue in favor of containers and k8s.
- evol262 4y agoLet me know when eBPF can probe into ring-1 hypercalls into a different kernel other than generically watching timing from vm_enter and vm_exit. Yes, there is a difference between "eBPF can probe what is happening in L0 of the host kernel" and "you can probe what is happening in other kernels in privileged ring-1 calls". No, this is not what you think it is.
- staticassertion 4y agoI'm not sure what you mean with regards to eBPF but the difference between a container and a VM is massive with regards to security. Incidentally, my company just published a writeup about Firecracker: https://news.ycombinator.com/item?id=32767784 https://news.ycombinator.com/item?id=32767784
- tptacek 4y agoIt is pretty obviously not the case that eBPF means shared-kernel containers are comparably as secure as VMs; there have been recent Linux kernel LPEs that no system call scrubbing BPF code would have caught, without specifically knowing about the bug first.