3 ms·

It's such a security nightmare it makes sense why few people do it anymore, it has nothing to do with cloud hipsters or whatever. A lot of these shared hosting

It's such a security nightmare it makes sense why few people do it anymore, it has nothing to do with cloud hipsters or whatever. A lot of these shared hosting companies were hacked constantly. 0-day local privilege escalation exploits aren't that difficult to find comparatively, there is a HUGE exposed surface area. IMHO If you share computing with random other people you want AT LEAST Intel VT/AMD-V virtualization for isolation.

chubot 2y ago
There is a risk, but I think you're overstating it I think the shared hosting companies have issues because of customers who host "grayware" and the like, although I'd probably agree they don't have enough security for a critical business like a bank or health care organization (I don't know much about their internals, but I know the Dreamhost has grsec-hardened kernels) IMHO If you share computing with random other people you want AT LEAST Intel VT/AMD-V virtualization for isolation. I think you can probably do this with Firecracker VMs. That is, preserve the shared hosting model, but have all the protections that VMs have. It might be possible to plug in firecracker purely through config, or make a slight patch to sshd. sshd already has support for ChrootDirectory, which is conceptually the same, but just a weaker form of isolation: https://unix.stackexchange.com/questions/542440/how-does-chrootdirectory-and-a-users-home-directory-work-together https://unix.stackexchange.com/questions/542440/how-does-chr... And then for a web process, you can mount some disk and a connection to a database into a Firecracker VM, etc.