3 ms·
I'm curious what the performance impact is like; I assume there has to be some slow down because of the interception of system calls?
by yjftsjthsd-h 3y ago
I'm curious what the performance impact is like; I assume there has to be some slow down because of the interception of system calls?
- hiatus 3y agoIt uses Reverie under the hood, which itself relies on ptrace (at least for the current, sole implementation). > Since ptrace adds significant overhead when the guest has a syscall-heavy workload, Reverie will add similarly-significant overhead. The slowdown depends on how many syscalls are being performed and are intercepted by the tool. > The primary way you can improve performance with the current implementation is to implement the subscriptions callback, specifying a minimal set of syscalls that are actually required by your tool. https://github.com/facebookexperimental/reverie https://github.com/facebookexperimental/reverie
- mananaysiempre 3y agoTangent: running old OSes (with no virtio support) under QEMU on Linux has the peculiar property that I/O-heavy portions such as installation can run faster under TCG (JIT) than under KVM (hardware virtualization), presumably due to all the trapping. It’s a toss-up when those also include CPU-heavy parts (decompression).
- TillE 3y ago> all thread executions are serialized so that there is effectively only one CPU This definitely isn't intended for general-purpose sandboxing. It's an interesting tool for analysis and debugging.
- yjftsjthsd-h 3y agoAh, I had missed that it effectively forces you to one CPU. Although I already would not use it for anything but testing account of it intentionally on unrandomizing things - I suspect, for instance, that it's unsafe to run any sort of cryptography that would create keys under this.