4 ms·
Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someon
by denhamparry 2y ago
Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someone were to break out of a container, they'd only see the zone processes. Not the host operating system or the hardware on the machine. The key difference here between us and other isolation implementations is that there is no performance degradation, you don't have to rebuild your container images, and that we don't require specific hardware (e.g. you can run Edera Protect on bare metal or on public cloud instances and everything else in-between).
- znpy 2y ago> Edera Protect creates Zones to isolate processes from other Zones What do you mean by "zone" exactly?
- sys_call 2y agoA zone is jargon for a virtual machine guest environment (an homage to Solaris Zones). Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management.
- klysm 2y agoHow exactly is this an improvement over VMs?
- sys_call 2y agoWe run unmodified containers in a VM guest environment, so you get the developer ergonomics of containers with the security and hardware controls of a VMM.
- znpy 2y ago> an homage to Solaris Zones i asked specifically because the word "zones" reminded me of solaris zones :) > Styrolite and Edera runs containers inside virtual machine guests for improved isolation and resource management. do your have your own vmm or is it firecracker with make up and a wig?
- xmodem 2y agoWhat underlying primitives are you relying on to provide isolation, if not linux namespaces? How does your approach compare to Google's gVisor?
- sys_call 2y agogVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace kernel that traps syscalls; it runs a type 1 hypervisor for better performance and security. You can read more in our whitepaper: http://arxiv.org/abs/2501.04580 http://arxiv.org/abs/2501.04580
- xmodem 2y agoThanks for the explanation. So you are using virtualisation-based techniques. I had incorrectly inferred from other comments that you were not. I skimmed the paper and it suggests your hypervisor can work without CPU-based virtualisation support - that's pretty neat. Many cloud environments do not have support for nested virtualisation extensions available (and also it tends to suck, so you shouldn't use it for production even if it is available). So there aren't many good options for running containers from different security domains on the same cloud instance. gVisor has been my go-to for that up until now. I will be sure to give this a shot!
- 0x1ceb00da 2y agoSo it's a lightweight way of running docker images inside a virtual machine?
- sys_call 2y agoYes, precisely. This also provides container operators with the benefits of a hypervisor, like memory ballooning, and dynamically allocating CPU and memory to workloads, improving resource utilization and the current node overprovisioning patterns.