5 ms·

GVisor: Linux-Compatible Sandbox

42 points by jesprenj 2y ago

mkayokay 2y ago
I find the README of the repo much better to quickly understand what this software is and isn't. https://github.com/google/gvisor https://github.com/google/gvisor
pjmlp 2y ago
One of those Go isn't for systems programming kind of projects. /s
- demi56 2y ago
  Systems Programming is kinda generic category and it ultimately depends on the individual to define what’s system programming and what’s not, is it performance, security or access to hardware
tsss 2y ago
I'd rather use firecracker before I trust another one of those half-baked Google projects.
- azornathogron 2y ago
  What's half-baked about GVisor? It's been in use as one of the security layers in various Google products for years, see for example: https://cloud.google.com/blog/products/containers-kubernetes/how-gvisor-protects-google-cloud-services-from-cve-2020-14386 https://cloud.google.com/blog/products/containers-kubernetes...
- ithkuil 2y ago
  IIRC you can't use firecracker if all you have are VMs and you don't have nested virtualization enabled. Does ec2 now support nested virtualization?
mococa 2y ago
Does anyone know if gVisor is used outside of Google? I know Firecracker is.
- Scaevolus 2y ago
  It's easy to run containers with different runtimes, so using gVisor (as "runsc") with Kubernetes or Docker is a simple matter of installing it and using the appropriate flags when starting a container. gVisor is nice when you're working with untrusted inputs, like ffmpeg transcode containers.
- __mattya 2y ago
  It is used by grist (https://www.getgrist.com https://www.getgrist.com) to sandbox Python formulas.
erulabs 2y ago
I used gVisor to sandbox containers for a short-lived "free-tier isolated-kubernetes-namespaces-as-a-service" startup. It was really neat, and it worked pretty damn well. Alas, we were attacked constantly by crypto miners and failed to make enough money to keep the free-tier online. I still think there are some really fun projects yet-to-be-built harnessing very solid sandboxing. I had dreamed of a full-stack geocities revival. Oh well. +1 for gVisor, hopefully filesystem IO is faster now than it was several years ago.

42 points by jesprenj 2y ago

I find the README of the repo much better to quickly understand what this software is and isn't. https://github.com/google/gvisor https://github.com/google/gvisor

pjmlp 2y ago

One of those Go isn't for systems programming kind of projects. /s

demi56 2y ago
Systems Programming is kinda generic category and it ultimately depends on the individual to define what’s system programming and what’s not, is it performance, security or access to hardware

tsss 2y ago

I'd rather use firecracker before I trust another one of those half-baked Google projects.

azornathogron 2y ago
What's half-baked about GVisor? It's been in use as one of the security layers in various Google products for years, see for example: https://cloud.google.com/blog/products/containers-kubernetes/how-gvisor-protects-google-cloud-services-from-cve-2020-14386 https://cloud.google.com/blog/products/containers-kubernetes...
ithkuil 2y ago
IIRC you can't use firecracker if all you have are VMs and you don't have nested virtualization enabled. Does ec2 now support nested virtualization?

mococa 2y ago

Does anyone know if gVisor is used outside of Google? I know Firecracker is.

Scaevolus 2y ago
It's easy to run containers with different runtimes, so using gVisor (as "runsc") with Kubernetes or Docker is a simple matter of installing it and using the appropriate flags when starting a container. gVisor is nice when you're working with untrusted inputs, like ffmpeg transcode containers.
__mattya 2y ago
It is used by grist (https://www.getgrist.com https://www.getgrist.com) to sandbox Python formulas.

erulabs 2y ago

I used gVisor to sandbox containers for a short-lived "free-tier isolated-kubernetes-namespaces-as-a-service" startup. It was really neat, and it worked pretty damn well. Alas, we were attacked constantly by crypto miners and failed to make enough money to keep the free-tier online. I still think there are some really fun projects yet-to-be-built harnessing very solid sandboxing. I had dreamed of a full-stack geocities revival. Oh well. +1 for gVisor, hopefully filesystem IO is faster now than it was several years ago.