3 ms·

> ... drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value ... Depends I guess as Android has had quite a b

> ... drastically restrict the syscall API surface available to the sandboxee, which quickly reduces its value ... Depends I guess as Android has had quite a bit of success with seccomp-bpf & Android-specific flavour of SELinux [0] > Until we have a properly hardened and memory safe OS ... faster than running MicroVMs on a Linux host. Andy Tanenbaum might say, Micro Kernels would do just as well. [0] https://youtu.be/WxbOq8IGEiE https://youtu.be/WxbOq8IGEiE

lillecarl 1y ago
You also have gVisor, which runs all syscall through some Go history that's supposedly safe enough for Google.
- bjackman 1y ago
  gVisor uses virtualization
bjackman 1y ago
> Android Exactly. Android pulls this off by being extremely constrained. It's dramatically less flexible than an OCI runtime. If you wanna run a random unenlightened workload on it you're probably gonna have a hard time. > Micro Kernels would do just as well. Yea this goes in the right direction. In the end a lot of kernel work I look at is basically about trying to retrofit benefits of microkernels onto Linux. Saying "we should just use an actual microkernel" is a bit like "Russia and Ukraine should just make peace" IMO though.