3 ms·
It looks like totally overengineered solution to me. The CPU already has a protected mode which doesn't allow the program to access any files directly. Why do y
by codedokode 4y ago
It looks like totally overengineered solution to me. The CPU already has a protected mode which doesn't allow the program to access any files directly. Why do you need to run a VM which by the way is run from the kernel (privileged mode) in Linux? Why cannot you run untrusted programs in protected mode?
- rogers18445 4y agoWith containers the entire surface area of the kernel is available to attack (syscalls). With a VM the surface is restricted to the VMM and KVM. This is an oversimplification, there may be other protocols that are passed through or utilized, they would add to the surface.