3 ms·

So, marketing hype to sell your clients, not a real technical use-case. Cgroups and kvm are basically the same age (kernel support in 2.6) so saying “cgroups i

So, marketing hype to sell your clients, not a real technical use-case. Cgroups and kvm are basically the same age (kernel support in 2.6) so saying “cgroups is newer so it must be more insecure” is fairly false. Firecracker is, in fact, quite new, and may or may not be more vulnerable as it is a completely new implementation of a kernel.

rmwaite 4y ago
Firecracker is essentially just KVM with some extremely opinionated choices to allow it to be as fast as it is. I’m hand-waving over a lot here but to differentiate it from KVM isn’t very useful here.
detaro 4y ago
> so saying “cgroups is newer so it must be more insecure” I did not say that. > as it is a completely new implementation of a kernel. Firecracker is not a "completely new implementation of a kernel", whatever that means.