4 ms·

Moving to unikernel [0] is the best way to get strong isolation and high performance [0] - https://unikraft.org https://unikraft.org

sidewndr46 1y ago
The last solution I looked at to do something like this was using tap / tun devices for networking. How does unikraft handle network isolation and virtualization?
- udev4096 1y ago
  From my limited understanding, it has the same isolation advantages as that of a VM and therefore it's as strong as the hypervisor you use
  - sidewndr46 1y ago
    so does unikraft contain a "driver" for virtio networking?
- johncolanduoni 1y ago
  It relies on your hypervisor and/or network hardware to provide that. In an ideal circumstance (e.g. running on a multiqueue NIC with VFIO or virtio acceleration), your VM can talk directly to the network hardware. Major clouds will provide something morally equivalent via their newer network interfaces (gVNIC etc.).
mikepurvis 1y ago
Absolutely, that reduces your surface area more than anything else, but at an enormous cost to ergonomics. Some of us are still fighting for docker images to not include a vim install ("but it's so handy!") and here we've got madlads building their app as its own bootable machine image.
johncolanduoni 1y ago
It’s not the best way to get low per-privilege domain overhead and fungible resource allocation. You’re ultimately limited by your hypervisor on those fronts. gVisor containers are ultimately a few Linux processes and mostly behave like one from a CPU and memory allocation perspective.
eyberg 1y ago
These people definitely do not understand security at all: https://github.com/unikraft/unikraft/issues/414 https://github.com/unikraft/unikraft/issues/414 Also - one needs to be careful cause many of the workloads they advertise on their site do not actually run under their kernel - it runs under linux which breaks a completely different type of trust barrier. As for trust/full disclosure - I'm with nanovms.com
- tkz1312 1y ago
  they acknowledged the issue and the fix was merged in 2022, what exactly is the criticism here?
  - eyberg 1y ago
    No it wasn't - you can still easily replicate. I just did. My point is that you shouldn't go around talking about how "secure" you are when you have large gaping things like this. This btw is not the only major security issue they have.
    - udev4096 1y ago
      Big fan of nanovms! I should have linked that instead, sorry
kang1 1y ago
not really, its just attack surface reduction

sidewndr46 1y ago

The last solution I looked at to do something like this was using tap / tun devices for networking. How does unikraft handle network isolation and virtualization?

udev4096 1y ago
From my limited understanding, it has the same isolation advantages as that of a VM and therefore it's as strong as the hypervisor you use
- sidewndr46 1y ago
  so does unikraft contain a "driver" for virtio networking?
johncolanduoni 1y ago
It relies on your hypervisor and/or network hardware to provide that. In an ideal circumstance (e.g. running on a multiqueue NIC with VFIO or virtio acceleration), your VM can talk directly to the network hardware. Major clouds will provide something morally equivalent via their newer network interfaces (gVNIC etc.).

mikepurvis 1y ago

Absolutely, that reduces your surface area more than anything else, but at an enormous cost to ergonomics. Some of us are still fighting for docker images to not include a vim install ("but it's so handy!") and here we've got madlads building their app as its own bootable machine image.

johncolanduoni 1y ago

It’s not the best way to get low per-privilege domain overhead and fungible resource allocation. You’re ultimately limited by your hypervisor on those fronts. gVisor containers are ultimately a few Linux processes and mostly behave like one from a CPU and memory allocation perspective.

eyberg 1y ago

These people definitely do not understand security at all: https://github.com/unikraft/unikraft/issues/414 https://github.com/unikraft/unikraft/issues/414 Also - one needs to be careful cause many of the workloads they advertise on their site do not actually run under their kernel - it runs under linux which breaks a completely different type of trust barrier. As for trust/full disclosure - I'm with nanovms.com

tkz1312 1y ago
they acknowledged the issue and the fix was merged in 2022, what exactly is the criticism here?
- eyberg 1y ago
  No it wasn't - you can still easily replicate. I just did. My point is that you shouldn't go around talking about how "secure" you are when you have large gaping things like this. This btw is not the only major security issue they have.
  - udev4096 1y ago
    Big fan of nanovms! I should have linked that instead, sorry

kang1 1y ago

not really, its just attack surface reduction