3 ms·

Multi-tenant systems are also a use-case (and a pretty major one).

• withinboredom 4y ago
  The kernel already guarantees isolation. Unless I missed the point of cgroups.
  • detaro 4y ago
    "guarantees". cgroups are indeed designed for isolation, but they are a feature that's been added on over time and still exposes the entire kernel as attack surface. It's considered way less trustworthy than VMs, especially minimal-surface ones like Firecracker.
    • withinboredom 4y ago
      So, marketing hype to sell your clients, not a real technical use-case. Cgroups and kvm are basically the same age (kernel support in 2.6) so saying “cgroups is newer so it must be more insecure” is fairly false. Firecracker is, in fact, quite new, and may or may not be more vulnerable as it is a completely new implementation of a kernel.
      • rmwaite 4y ago
        Firecracker is essentially just KVM with some extremely opinionated choices to allow it to be as fast as it is. I’m hand-waving over a lot here but to differentiate it from KVM isn’t very useful here.
      • detaro 4y ago
        > so saying “cgroups is newer so it must be more insecure” I did not say that. > as it is a completely new implementation of a kernel. Firecracker is not a "completely new implementation of a kernel", whatever that means.