4 ms·

So, wait. You’re saying the people who developed that squeeze juice thing or the drop of blood thing shouldn’t be criticized because it is obviously a stupid id

So, wait. You’re saying the people who developed that squeeze juice thing or the drop of blood thing shouldn’t be criticized because it is obviously a stupid idea from the get-go? C’mon man, some of us have critical thinking skills and some of us will tell you when an idea is stupid or over-engineered. Containers as VMs is usually peak over-engineering. It’s unnecessary most of the time. In fact, there’s only a few use-cases where it’s desired to have that isolation: - different clock rates in the container than outside (deliberate skew) - high security applications - require certain kernel modules that you don’t want installed in all containers Isolation can already be guaranteed by the kernel (excepting some bugs), so I don’t think that is a valid use-case, but I could be wrong.

mbreese 4y ago
Multi-tenant systems are also a use-case (and a pretty major one).
- withinboredom 4y ago
  The kernel already guarantees isolation. Unless I missed the point of cgroups.
  - detaro 4y ago
    "guarantees". cgroups are indeed designed for isolation, but they are a feature that's been added on over time and still exposes the entire kernel as attack surface. It's considered way less trustworthy than VMs, especially minimal-surface ones like Firecracker.
    - withinboredom 4y ago
      So, marketing hype to sell your clients, not a real technical use-case. Cgroups and kvm are basically the same age (kernel support in 2.6) so saying “cgroups is newer so it must be more insecure” is fairly false. Firecracker is, in fact, quite new, and may or may not be more vulnerable as it is a completely new implementation of a kernel.
      - rmwaite 4y ago
        Firecracker is essentially just KVM with some extremely opinionated choices to allow it to be as fast as it is. I’m hand-waving over a lot here but to differentiate it from KVM isn’t very useful here.
      - detaro 4y ago
        > so saying “cgroups is newer so it must be more insecure” I did not say that. > as it is a completely new implementation of a kernel. Firecracker is not a "completely new implementation of a kernel", whatever that means.

mbreese 4y ago

Multi-tenant systems are also a use-case (and a pretty major one).

withinboredom 4y ago
The kernel already guarantees isolation. Unless I missed the point of cgroups.
- detaro 4y ago
  "guarantees". cgroups are indeed designed for isolation, but they are a feature that's been added on over time and still exposes the entire kernel as attack surface. It's considered way less trustworthy than VMs, especially minimal-surface ones like Firecracker.
  - withinboredom 4y ago
    So, marketing hype to sell your clients, not a real technical use-case. Cgroups and kvm are basically the same age (kernel support in 2.6) so saying “cgroups is newer so it must be more insecure” is fairly false. Firecracker is, in fact, quite new, and may or may not be more vulnerable as it is a completely new implementation of a kernel.
    - rmwaite 4y ago
      Firecracker is essentially just KVM with some extremely opinionated choices to allow it to be as fast as it is. I’m hand-waving over a lot here but to differentiate it from KVM isn’t very useful here.
    - detaro 4y ago
      > so saying “cgroups is newer so it must be more insecure” I did not say that. > as it is a completely new implementation of a kernel. Firecracker is not a "completely new implementation of a kernel", whatever that means.