4 ms·

Nothing about resource (net, io, disk, cpu) isolation, limits, priorities, or guarantees. Not the same as a type 1 hypervisor. These qualities are needed to run

Nothing about resource (net, io, disk, cpu) isolation, limits, priorities, or guarantees. Not the same as a type 1 hypervisor. These qualities are needed to run things safely and predictably in the real world™, at scale. Also, accounting and multitenancy if it's going to be used as some sort VAR or VPS offering.

loloquwowndueo 1y ago
Took a few seconds of googling to find this: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#instance-options-limits https://linuxcontainers.org/incus/docs/main/reference/instan...
tok1 1y ago
Fun fact, Incus is being used as underlying infrastructure for the NorthSec CTF, i.e. in an "as hostile as it can get" environment. If you have close to a hundred teams of hackers on your systems trying to break stuff, I think it speaks for Incus and its capabilities regarding isolation and limits. In case you are interested, Zabbly has some interesting behind-the-scenes on Youtube (not affiliated).
- mdaniel 1y ago
  I would guess <https://www.youtube.com/watch?v=7A1yrLRNIp0 https://www.youtube.com/watch?v=7A1yrLRNIp0> is a good starting point "Looking at the NorthSec infrastructure" from April, 2024 The YT description also points to https://github.com/zabbly/incus https://github.com/zabbly/incus
- maple3142 1y ago
  If being used in a CTF counts, then running latest docker with no extra privilege and non-root user on a reasonably up-to-date kernel meets the definition of secure I think. At least for what I have seen, this kind of infrastructure is pretty common in CTF.
goku12 1y ago
Incus supports Qemu/KVM VMs. And KVM is arguably a Type 1 hypervisor since it's part of the Linux kernel. So I guess it qualifies?