3 ms·
> Modal has an isolated container runtime that lets us share each host’s CPU and memory between workloads. Looks like Modal hosts workloads in Containers, not
by ATechGuy 2y ago
> Modal has an isolated container runtime that lets us share each host’s CPU and memory between workloads.
Looks like Modal hosts workloads in Containers, not VMs. How do you enforce secure isolation with this design? A single kernel vulnerability could lead to remote execution on the host, impacting all workloads . Am I missing anything?
- ekzhang 2y agoI mentioned this in another comment thread, but we use gVisor to enforce isolation. https://gvisor.dev/users/ https://gvisor.dev/users/ It's also used by Google Kubernetes Engine, OpenAI, and Cloudflare among others to run untrusted code.