4 ms·
Because that means you are sharing kernel with the sandboxed agent. Virtualization presents an infinitely smaller attack surface.
by matheusmoreira 4mo ago
Because that means you are sharing kernel with the sandboxed agent. Virtualization presents an infinitely smaller attack surface.
- hwc 4mo agoIf there is any attack surface within a properly-configured container, that's a kernel bug, right?
- matheusmoreira 4mo agoProbably. If I remember correctly, containers on Linux are implemented using the kernel's namespaces. The same ones which became famous for the vulnerabilities they surfaced in previously unexercised code.
- croes 4mo agoThen use SmolVM
- matheusmoreira 4mo agoI'm already using virtdev, my own solution built on top of QEMU.