3 ms·
What do you possibly gain by introducing VT-* features into your container product?
by feld 12y ago
What do you possibly gain by introducing VT-* features into your container product?
- justinsb 12y agoI would imagine you would get better security and performance isolation
- feld 12y agoAt the cost of whatever bugs/vulnerabilities exist in the VT-* implementation on the silicon
- regularfry 12y agoAt the moment, the container host exposes any kernel vulnerability to the container guests; that's a large enough attack surface that the advice I've most frequently come across is "Run your customer's containers in a VM so they can't attack your host". That's obviously less than ideal, so if VT-* can add a layer of isolation such that I don't need a VM layer in the infrastructure, it's worth it.
- feld 12y agoSo you're not longer sharing a kernel with the host?
- regularfry 12y agoThe VM doesn't share a kernel with the host, no. Without knowing exactly what virtualisation knobs Canonical are planning on adding here, it's difficult to say how much isolation is on the table.
- evol262 12y agoIsolation. uid 0 is treated specially, and root breakouts inside containers (especially containers which aren't constrained by the audit subsystem in some way, like grsec or selinux or apparmor) or kernel exploits can bust your whole system open, among other security risks with containers. hypervisor breakouts exist, but they're much rarer.