4 ms·

> These micro VMs operate without a kernel or operating system, keeping overhead low. Instead, guests are built specifically for Hyperlight using the Hyperlight

> These micro VMs operate without a kernel or operating system, keeping overhead low. Instead, guests are built specifically for Hyperlight using the Hyperlight Guest library, which provides a controlled set of APIs that facilitate interaction between host and guest Sounds like this is closer to a chroot/unikernel than a "micro VM" - a slightly more firewalled chroot without most of the os libs, or a unikernel without the kernel. Pretty sure it's not a "virtual machine" though. Only pointing this out because these sorts of containers/unikernels/vms exist on a spectrum, and each type carries its own strengths and limitations; calling this by the wrong name associates it with the wrong set of tradeoffs.

wmf 2y ago
I guess if it uses CR3 it's a "process" and if it uses VMLAUNCH it's a "VM".
- generalizations 2y ago
  Heh. Going by that delineation we end up with very VM-ish containers and (now) very container-ish VMs. Though this seems like it's even more stripped down than a unikernel - which would also be a "VM" here.
0cf8612b2e1e 2y ago
I thought a chroot was not considered a real security boundary?
- ronsor 2y ago
  Chroot is a real security boundary as long as you use it properly. That said, namespaces on Linux are much superior at this point, so I can only recommend using `chroot` for POSIX compliance.
  - derefr 2y ago
    chroot is great for all sorts of things, but they're not security-related. A lot of tools expect to do things to "your system" at absolute paths — chroot lets those tools operate against an explicitly wired-up semi-virtualized simulacra of your system, designed to pass through just the parts of those operations you want to your real host, while routing the rest of the effects into a "rootfs in a can", that you're either building up, or will immediately throw away. Think: debootstrap; or pivot-root; or mounting your rootfs to fix your GRUB config and re-run update-grub from your initramfs rescue shell.
- kevincox 2y ago
  Yes. Anything that shares a kernel is a very weak security boundary as the kernel is complex and vulnerabilities are regularly discovered.
0x457 2y ago
Okay, so every name in this post makes sense it's just some of these words started to mean very different things with time. This is not a hypervisor or a vm manager. It's a library that lets you run a C or Rust function[1] inside a VM managed by platform hypervisor[2]. [1]: As in Function (computer programming) not a AWS Lambda. [2]: KVM or mshv on Linux and Windows Hypervisor on linux

wmf 2y ago

I guess if it uses CR3 it's a "process" and if it uses VMLAUNCH it's a "VM".

generalizations 2y ago
Heh. Going by that delineation we end up with very VM-ish containers and (now) very container-ish VMs. Though this seems like it's even more stripped down than a unikernel - which would also be a "VM" here.

0cf8612b2e1e 2y ago

I thought a chroot was not considered a real security boundary?

ronsor 2y ago
Chroot is a real security boundary as long as you use it properly. That said, namespaces on Linux are much superior at this point, so I can only recommend using `chroot` for POSIX compliance.
- derefr 2y ago
  chroot is great for all sorts of things, but they're not security-related. A lot of tools expect to do things to "your system" at absolute paths — chroot lets those tools operate against an explicitly wired-up semi-virtualized simulacra of your system, designed to pass through just the parts of those operations you want to your real host, while routing the rest of the effects into a "rootfs in a can", that you're either building up, or will immediately throw away. Think: debootstrap; or pivot-root; or mounting your rootfs to fix your GRUB config and re-run update-grub from your initramfs rescue shell.
kevincox 2y ago
Yes. Anything that shares a kernel is a very weak security boundary as the kernel is complex and vulnerabilities are regularly discovered.

0x457 2y ago

Okay, so every name in this post makes sense it's just some of these words started to mean very different things with time. This is not a hypervisor or a vm manager. It's a library that lets you run a C or Rust function[1] inside a VM managed by platform hypervisor[2]. [1]: As in Function (computer programming) not a AWS Lambda. [2]: KVM or mshv on Linux and Windows Hypervisor on linux