5 ms·
I'm not interested in a VM which supports mounting host filesystems in untrusted Kubernetes pods.
by srcreigh 13d ago
I'm not interested in a VM which supports mounting host filesystems in untrusted Kubernetes pods.
- LeBit 13d agosmolvm integrates with k8s (https://smolmachines.com/docs/guides/kubernetes-in-a-microvm#vm-per-pod https://smolmachines.com/docs/guides/kubernetes-in-a-microvm...) and can mount s3 buckets (https://smolmachines.com/docs/local/machine-lifecycle-cli-reference#mount-an-s3-bucket https://smolmachines.com/docs/local/machine-lifecycle-cli-re...). I wouldn’t dismiss smolvm so fast. It brings together many ideas that make the whole very interesting.
- srcreigh 13d agoIt doesn’t provide isolation. It is not even part of the conversation.
- Melatonic 13d agoI thought the whole point of a microVM is that it does provide isolation ?
- LeBit 13d agoWhat do you mean by "It doesn’t provide isolation" ? How so ?
- srcreigh 13d agoThis post explains how a GPT agent broke out of qemu VM. It could not break out of firecracker. https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/ https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyb... Why? Firecracker mounts very few host systems into the VM, exposing minimal host code to malicious guests. Qemu and smolvm expose much more. So yeah, smolvm is more like a docker or qemu alternative, definitely useful but NOT relevant to the discussion of sandboxing malicious code
- chrisweekly 13d agoBut smolvm provides kernel-level isolation. Much closer to firecracker than docker.
- srcreigh 13d agoIf your networking stack and filesystem and who knows what else are exposed to the guest, its not isolation. It’s better than Docker, but it can’t be compared to Firecracker at all. Firecracker actually minimizes the attack surface whereas smolvm does not