4 ms·
if your security model assumes user code is able to break out of containers, then it also has to assume user code will be able to modify the VM if user code ca
by preseinger 4y ago
if your security model assumes user code is able to break out of containers, then it also has to assume user code will be able to modify the VM
if user code can modify the VM, and VMs are stateful, then how do you ensure hermetic builds?
- adamgordonbell 4y agoSo the builds are specified in Earthfiles, which are run by our buildkit backend. Buildkit runs the builds in runC, so basically containers are used to keep things deterministic, but the buildkit backend isn't shared, each is in own EC2 instance. So if you could break out or access cache entries that weren't correct you would have found a way to break reproducibility, but not access anything you shouldn't.
- preseinger 4y agoah, okay, so you're using containers, you're running those containers on VMs that are per-customer rather than shared/multi-tenant, and the post is about optimizing how those VMs are managed -- got it > but the buildkit backend isn't shared, each is in own EC2 instance it isn't shared between different customers, but it is shared between different builds for the same customer, right?