3 ms·

Isolated, but are they isolated enough? The article states that containers offer weaker isolation than VMs. (it doesn't quantify it though and I don't know this

Isolated, but are they isolated enough? The article states that containers offer weaker isolation than VMs. (it doesn't quantify it though and I don't know this kind of thing offhand)

codedokode 3y ago
Processes run in a userspace and cannot do anything without OS approval.
- akdev1l 3y ago
  The kernel can be attacked and exploited. Container escape exploits are more common than VM escape exploits.
- kevincox 3y ago
  The Linux kernel has far too large of an attack surface to be trusted as a hard security boundary. It is good enough to prevent mostly trusted software from accidentally interfering with each other but I would not trust it to protect me from an untrusted workload. For example GCP and AWS both have container running services. They both use hardware VMs to isolate different tenants. You will never share a kernel with another customer (I don't even think you will share one with yourself by default).
  - codedokode 3y ago
    Maybe you need a better kernel then? For example, a microkernel.
- fhuici 3y ago
  I agree with the other comments. On the cloud, the VM is still the golden standard for strong (hardware-level isolation): if you deploy a container in the cloud, you can almost be sure there's a VM underneath. Given this, what we tried to do in that paper, in the LF Unikraft project (www.unikraft), and on kraft.cloud, is ensure that each VM only has the thinnest possible layer between the application and the hypervisor underneath -- strong isolation and hopefully max efficiency. We do use Dockerfiles to have users specify the app/filesystem, but then we transparently convert them to unikernels (specialized VMs) at deploy time.
- brap 3y ago
  Everything you said is correct, in theory. In practice, however...
macspoofing 3y ago
Who is complaining? And if containers do not offer enough of an isolation, why would you think VMs do? There are use cases where you have to have host-level isolation - for example, if you want to build a HIPAA-compliant cloud service, your customer data has to be isolated at the host level and VMs are not enough.

Isolated, but are they isolated enough? The article states that containers offer weaker isolation than VMs. (it doesn't quantify it though and I don't know this kind of thing offhand)

codedokode 3y ago

Processes run in a userspace and cannot do anything without OS approval.

akdev1l 3y ago
The kernel can be attacked and exploited. Container escape exploits are more common than VM escape exploits.
kevincox 3y ago
The Linux kernel has far too large of an attack surface to be trusted as a hard security boundary. It is good enough to prevent mostly trusted software from accidentally interfering with each other but I would not trust it to protect me from an untrusted workload. For example GCP and AWS both have container running services. They both use hardware VMs to isolate different tenants. You will never share a kernel with another customer (I don't even think you will share one with yourself by default).
- codedokode 3y ago
  Maybe you need a better kernel then? For example, a microkernel.
fhuici 3y ago
I agree with the other comments. On the cloud, the VM is still the golden standard for strong (hardware-level isolation): if you deploy a container in the cloud, you can almost be sure there's a VM underneath. Given this, what we tried to do in that paper, in the LF Unikraft project (www.unikraft), and on kraft.cloud, is ensure that each VM only has the thinnest possible layer between the application and the hypervisor underneath -- strong isolation and hopefully max efficiency. We do use Dockerfiles to have users specify the app/filesystem, but then we transparently convert them to unikernels (specialized VMs) at deploy time.
brap 3y ago
Everything you said is correct, in theory. In practice, however...

macspoofing 3y ago

Who is complaining? And if containers do not offer enough of an isolation, why would you think VMs do? There are use cases where you have to have host-level isolation - for example, if you want to build a HIPAA-compliant cloud service, your customer data has to be isolated at the host level and VMs are not enough.