3 ms·
Note that some cloud VM types expose entire NVMe drives as-is directly the guest operating system without hypervisors or other abstractions in the way. The Azu
by jiggawatts 3y ago
Note that some cloud VM types expose entire NVMe drives as-is directly the guest operating system without hypervisors or other abstractions in the way.
The Azure Lv3/Lsv3/Lav3/Lasv3 series all provide this capability, for example.
Ref: https://learn.microsoft.com/en-us/azure/virtual-machines/lasv3-series https://learn.microsoft.com/en-us/azure/virtual-machines/las...
- rwmj 3y agoIs there not any danger of tenants rewriting the firmware on these drives, and surprising (or compromising) future tenants? AIUI this is the central reason why even "baremetal" cloud instances still have a minimal hypervisor between the tenant and the hardware.
- nixgeek 3y agoI’m not sure what makes you think an “minimal hypervisor” exists — Oracle Cloud Infrastructure doesn’t have a hypervisor of any sort between you and its .metal instance types. Don’t think Amazon EC2 does either.
- rwmj 3y agoAmazon have their own partitioning hypervisor for this purpose. It sits below any hypervisor that might be visible to the tenant.
- wmf 3y agoThe top clouds (AWS/Azure/Google) have custom firmware to solve this problem. Second-tier clouds probably don't so customers can reflash firmware.
- otterley 3y agoIf your second sentence is true -- and I hope it isn't! -- that would be a gaping security hole.
- wmf 3y agoTo be fair, some of the bare metal providers reflash firmware when the machine is reprovisioned. In theory firmware "implants" could survive reflashing but I don't know if such a thing has ever been seen in the wild.
- nerpderp82 3y agoThis needs to be taken into account when running on metal instances with different cloud providers. You would also want an assurance that metal instances aren't ever repurposed to be VM hosts in the future.
- idanp 3y agoVirtualization can happen in the hardware itself, e.g. SR-IOV.