3 ms·

What is firecracker needed? Couldn’t this just run in a container directly? I understand some of the isolation concerns but a browser and container breakout is

• arianvanp 4mo ago
  If you follow the kernel mailing list container breakout exploits are currently a weekly occurrence
  • gregpr07 4mo ago
    Oh really, not a security expert, but could you send me some examples?
    • rvz 4mo ago
      https://copy.fail https://copy.fail
  • hnav 4mo ago
    Though it is true that bleeding edge browsers are fairly secure.
• WhyNotHugo 4mo ago
  You can take a snapshot of a microVM and roll back. I've never heard of this being done with containers.
  • hnav 4mo ago
    You can have a volume mount into your container backed by whatever block storage which may have snapshotting or format with a FS that supports snapshots.
    • saltmate 4mo ago
      The VM snapshot/load is about memory, not storage.
• flaminHotSpeedo 4mo ago
  Most mature and/or security conscious providers don't consider containers to be a secure isolation boundary (with Microsoft being a notable exception, though it's unclear whether that's a failure of internal policy or incompetent enforcement of policy). Containers provide a much broader attack surface than VM's, and since they're not considered secure as an industry standard there's likely to be less resources put towards managing container escape CVE's than VM escape ones.
  • y2244 4mo ago
    But everyone is running containers on Kubernetes?