6 ms·

Definitely not the minority, anyone who needs secure isolation for a container should be wrapping it in a single tenant VM

• throwoutway 3y ago
  Firecracker has often been recommended (here on HN and elsewhere) for a VM-for container-execution model : https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker
  • tptacek 3y ago
    There's also Cloud Hypervisor, which is very similar, and based off some of the same crosvm code and ideas. https://github.com/cloud-hypervisor/cloud-hypervisor https://github.com/cloud-hypervisor/cloud-hypervisor
    • westurner 3y ago
      gvisor; `runsc`: https://gvisor.dev/docs/ https://gvisor.dev/docs/ : > gVisor provides a virtualized environment in order to sandbox containers. The system interfaces normally implemented by the host kernel are moved into a distinct, per-sandbox application kernel in order to minimize the risk of a container escape exploit. gVisor does not introduce large fixed overheads however, and still retains a process-like model with respect to resource utilization. https://news.ycombinator.com/item?id=38609105 https://news.ycombinator.com/item?id=38609105 kata containers: https://github.com/kata-containers https://github.com/kata-containers : > Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.