3 ms·
BS. Unless we're talking 0-day/CVE, running an unprivileged container is as trustable as a VM. The only difference is how strictly you want to hold the memory/
by cognitiveinline 2mo ago
BS.
Unless we're talking 0-day/CVE, running an unprivileged container is as trustable as a VM. The only difference is how strictly you want to hold the memory/CPU bar. Infact on linux, containers are more lightweight than VMs.
So yeah, not "vulnerable".
- angry_octet 2mo agoLLMs are great at finding 0-day, and people are rubbish at updating their containers and hosts to patch b-day. Containers have access to the kernel ABI, and as shown in the latest kernel exploits, all the memory handling surface that exposes. The virtualisation interface, offering fewer services, is significantly harder. Containers are obviously lighter than VMs, both to start and to schedule, but firecracker is pretty fast. gVisor pays overhead per syscall vs at startup. So yeah, more vulnerable.
- cognitiveinline 2mo agoGot it. 0 days are possible so throwaway containerization. You should blog about it, will help millions of developers and companies. Heck, even consult with the hyperscalers - they will be riddled with their workloads.
- angry_octet 2mo agoWho do you think created firecracker? gVisor?
- teravor 2mo agogvisor's overhead is mostly IO. especially if you use the KVM backend.