3 ms·
Secure VMs for Kubernetes: Hardening Kata Containers
- d3Xt3r 7d agoI'm curious if you've looked at a fundamentally different solution - namely, mklinux[1]? You not only skip the entire KVM/Firecracker VMM/Kata Shim/Guest Linux/Kata Agent stack which achieves your goal of reducing the attack surface, using mklinux also mitigated entire classes of vulnerabilities such as buffer overflows/out-of-bounds I/O in the virtio stack, speculative execution side-channels, SLAT bugs etc. [1] https://multikernel.io/technology.html https://multikernel.io/technology.html
- srcreigh 7d agoThanks! No haven’t heard of this. Do you have any experience deploying untrusted workloads with this tool? care to share some more info ?