4 ms·

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why containe

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

klysm 2y ago
Say “it’s probably fine” and hope that the people building the foundational systems are protecting us
- Joker_vD 2y ago
  No, I mean, what do the Edera developers do differently, in order to provide more robust foundation with this new container runtime called Styrolite? They still use Linux namespaces, as far as I can tell from TFA.
  - denhamparry 2y ago
    Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someone were to break out of a container, they'd only see the zone processes. Not the host operating system or the hardware on the machine. The key difference here between us and other isolation implementations is that there is no performance degradation, you don't have to rebuild your container images, and that we don't require specific hardware (e.g. you can run Edera Protect on bare metal or on public cloud instances and everything else in-between).
    - znpy 2y ago
      > Edera Protect creates Zones to isolate processes from other Zones What do you mean by "zone" exactly?
      - sys_call 2y ago
        A zone is jargon for a virtual machine guest environment (an homage to Solaris Zones). Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.
        klysm 2y ago
        How exactly is this an improvement over VMs?
        sys_call 2y ago
        We run unmodified containers in a VM guest environment, so you get the developer ergonomics of containers with the security and hardware controls of a VMM.
        znpy 2y ago
        > an homage to Solaris Zones i asked specifically because the word "zones" reminded me of solaris zones :) > Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management. do your have your own vmm or is it firecracker with make up and a wig?
    - xmodem 2y ago
      What underlying primitives are you relying on to provide isolation, if not linux namespaces? How does your approach compare to Google's gVisor?
      - sys_call 2y ago
        gVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace kernel that traps syscalls; it runs a type 1 hypervisor for better performance and security. You can read more in our whitepaper: http://arxiv.org/abs/2501.04580 http://arxiv.org/abs/2501.04580
        xmodem 2y ago
        Thanks for the explanation. So you are using virtualisation-based techniques. I had incorrectly inferred from other comments that you were not. I skimmed the paper and it suggests your hypervisor can work without CPU-based virtualisation support - that's pretty neat. Many cloud environments do not have support for nested virtualisation extensions available (and also it tends to suck, so you shouldn't use it for production even if it is available). So there aren't many good options for running containers from different security domains on the same cloud instance. gVisor has been my go-to for that up until now. I will be sure to give this a shot!
        0x1ceb00da 2y ago
        So it's a lightweight way of running docker images inside a virtual machine?
        sys_call 2y ago
        Yes, precisely. This also provides container operators with the benefits of a hypervisor, like memory ballooning, and dynamically allocating CPU and memory to workloads, improving resource utilization and the current node overprovisioning patterns.
z3t4 2y ago
Once you have set up the namespaces you drop all capabilities so if the program gets hacked while it's running it can do very little.
- denhamparry 2y ago
  Edera developer here. I agree! But there are instances we need to run with additional capabilities, and we’re also dependent on people knowing how to do the right thing. We’re trying to improve this by setting this by default, but also improving the overall performance and efficiency of running containers
- znpy 2y ago
  honest question: how is this any better than running non-root containers? They can do very little anyway, that way.
  - sys_call 2y ago
    Non-root containers still operate under a shared kernel. Non-root containers that run under a vulnerable kernel can lead to privilege escalation and container escapes. Styrolite is a container runtime engine that runs containers in a virtual machine guest environment with no shared kernel state. It uses a type 1 hypervisor to fully isolate a running container from the node and other containers. It's similar to Firecracker or Kata containers, but doesn't require bare metal instances (runs on standard EC2, etc) and utilizes paravirtualization.
  - deleted 2y ago
    [deleted]
flkenosad 2y ago
Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.
- GardenLetter27 2y ago
  A lot of use cases don't want that though. It's nice having lightweight network namespaces for example, just to separate the network stack for tunneling but still have X and Wayland working fine with the applications running there.
- eyberg 2y ago
  When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they are required to cover is so large but more importantly it doesn't have isolation at the cpu level (eg: intel vt-x such as VMREAD, VMWRITE, VMLAUNCH, VMXOFF, VMXON). This is what the entire public cloud is built on. You don't really read articles that often where someone is talking about breaking vm isolation on AWS and spying on the other tenants on the server.
  - flaminHotSpeedo 2y ago
    > This is what the entire public cloud is built on. Well... The entire public cloud except Azure. They've been caught multiple times for vulnerabilities stemming from the lack of hardware backed isolation between tenants.
    - richardwhiuk 2y ago
      Azure has the same level of isolation for VMs at a hardware level as AWS.
      - flaminHotSpeedo 2y ago
        How Azure isolates VM's is completely unrelated, because containers are not VM's. And if you meant to assert that Azure uses hardware assisted isolation between tenants in general, that was not the case for azurescape [1] or chaosDB [2]. [1] https://unit42.paloaltonetworks.com/azure-container-instances/ https://unit42.paloaltonetworks.com/azure-container-instance... [2] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

klysm 2y ago

Say “it’s probably fine” and hope that the people building the foundational systems are protecting us

Joker_vD 2y ago
No, I mean, what do the Edera developers do differently, in order to provide more robust foundation with this new container runtime called Styrolite? They still use Linux namespaces, as far as I can tell from TFA.
- denhamparry 2y ago
  Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someone were to break out of a container, they'd only see the zone processes. Not the host operating system or the hardware on the machine. The key difference here between us and other isolation implementations is that there is no performance degradation, you don't have to rebuild your container images, and that we don't require specific hardware (e.g. you can run Edera Protect on bare metal or on public cloud instances and everything else in-between).
  - znpy 2y ago
    > Edera Protect creates Zones to isolate processes from other Zones What do you mean by "zone" exactly?
    - sys_call 2y ago
      A zone is jargon for a virtual machine guest environment (an homage to Solaris Zones). Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.
      - klysm 2y ago
        How exactly is this an improvement over VMs?
        sys_call 2y ago
        We run unmodified containers in a VM guest environment, so you get the developer ergonomics of containers with the security and hardware controls of a VMM.
      - znpy 2y ago
        > an homage to Solaris Zones i asked specifically because the word "zones" reminded me of solaris zones :) > Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management. do your have your own vmm or is it firecracker with make up and a wig?
  - xmodem 2y ago
    What underlying primitives are you relying on to provide isolation, if not linux namespaces? How does your approach compare to Google's gVisor?
    - sys_call 2y ago
      gVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace kernel that traps syscalls; it runs a type 1 hypervisor for better performance and security. You can read more in our whitepaper: http://arxiv.org/abs/2501.04580 http://arxiv.org/abs/2501.04580
      - xmodem 2y ago
        Thanks for the explanation. So you are using virtualisation-based techniques. I had incorrectly inferred from other comments that you were not. I skimmed the paper and it suggests your hypervisor can work without CPU-based virtualisation support - that's pretty neat. Many cloud environments do not have support for nested virtualisation extensions available (and also it tends to suck, so you shouldn't use it for production even if it is available). So there aren't many good options for running containers from different security domains on the same cloud instance. gVisor has been my go-to for that up until now. I will be sure to give this a shot!
      - 0x1ceb00da 2y ago
        So it's a lightweight way of running docker images inside a virtual machine?
        sys_call 2y ago
        Yes, precisely. This also provides container operators with the benefits of a hypervisor, like memory ballooning, and dynamically allocating CPU and memory to workloads, improving resource utilization and the current node overprovisioning patterns.

z3t4 2y ago

Once you have set up the namespaces you drop all capabilities so if the program gets hacked while it's running it can do very little.

denhamparry 2y ago
Edera developer here. I agree! But there are instances we need to run with additional capabilities, and we’re also dependent on people knowing how to do the right thing. We’re trying to improve this by setting this by default, but also improving the overall performance and efficiency of running containers
znpy 2y ago
honest question: how is this any better than running non-root containers? They can do very little anyway, that way.
- sys_call 2y ago
  Non-root containers still operate under a shared kernel. Non-root containers that run under a vulnerable kernel can lead to privilege escalation and container escapes. Styrolite is a container runtime engine that runs containers in a virtual machine guest environment with no shared kernel state. It uses a type 1 hypervisor to fully isolate a running container from the node and other containers. It's similar to Firecracker or Kata containers, but doesn't require bare metal instances (runs on standard EC2, etc) and utilizes paravirtualization.
- deleted 2y ago
  [deleted]

flkenosad 2y ago

Anyone know if it's possible to update the Linux kernel so that namespaces are hard security boundaries? I wonder what that would entail.

GardenLetter27 2y ago
A lot of use cases don't want that though. It's nice having lightweight network namespaces for example, just to separate the network stack for tunneling but still have X and Wayland working fine with the applications running there.
eyberg 2y ago
When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they are required to cover is so large but more importantly it doesn't have isolation at the cpu level (eg: intel vt-x such as VMREAD, VMWRITE, VMLAUNCH, VMXOFF, VMXON). This is what the entire public cloud is built on. You don't really read articles that often where someone is talking about breaking vm isolation on AWS and spying on the other tenants on the server.
- flaminHotSpeedo 2y ago
  > This is what the entire public cloud is built on. Well... The entire public cloud except Azure. They've been caught multiple times for vulnerabilities stemming from the lack of hardware backed isolation between tenants.
  - richardwhiuk 2y ago
    Azure has the same level of isolation for VMs at a hardware level as AWS.
    - flaminHotSpeedo 2y ago
      How Azure isolates VM's is completely unrelated, because containers are not VM's. And if you meant to assert that Azure uses hardware assisted isolation between tenants in general, that was not the case for azurescape [1] or chaosDB [2]. [1] https://unit42.paloaltonetworks.com/azure-container-instances/ https://unit42.paloaltonetworks.com/azure-container-instance... [2] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...