eyberg

12 ms·

121.
by eyberg 3y ago
We too ended up adding pledge and unveil to Nanos. Seccomp and seccomp-bpf are indeed entirely way too limiting. It wasn't really designed for end app developers who are, imo, the ones that should be dictating the policy. The whole lac
122.
by eyberg 3y ago
I'm completely biased since I cut these packages but for this particular example of "run a wasm payload inside of a unikernel": ops pkg load eyberg/wasmedge:0.9.1 -c config.json You could replicate this is secon
123.
by eyberg 3y ago
Nanos runs not just go but pretty much any language you want to throw at it: https://github.com/nanovms/ops-examples .
124.
by eyberg 3y ago
This is a rather old and incorrect talking point. Nanos has had strace/ftrace/gdb, plenty of apm/monitoring such as cloudwatch and all sorts of tools in/around that realm for years now. https://docs.ops.city&#
125.
by eyberg 3y ago
We did this with wireguard: https://nanovms.com/dev/tutorials/running-nanos-wireguard-vp... .
126.
Refactoring Nginx Worker Processes to Be Multi-Threaded(nanovms.com)
7 points by eyberg 3y ago|0 comments
127.
by eyberg 3y ago
This is one of the few comments here I actually agree with. Totally agree our current architecture is totally broken. It sounds like ARM MTE is coming soonish so excited to see that.
128.
by eyberg 3y ago
> So? Again, as many others have pointed out, neither do OSes unless you can somehow guarantee they're mapping memory in with an MMU or MPU with flags lacking X/W. You're still trusting the OS to do it right, the linker to
129.
by eyberg 3y ago
Well I think it's been pointed out, repeatedly, that wasm needs memory protection. I'm very far from the only person pointing out a lot of this btw: https://www.usenix.org/system/files/sec20_slides_lehman
130.
by eyberg 3y ago
Well no it is not. You can't run that on linux which I'd imagine most people who are wanting to do server-side wasm are coming from. This is another issue: #include <stdio.h> #include <stdlib.h> int main
131.
by eyberg 3y ago
Again, it's not really 'native binary' vs wasm. The binary can only really tell the os what it expects it to do. It is more of 'operating system' vs wasm. By no means an authoritative list and I've not brought
132.
by eyberg 3y ago
The problem as I pointed out in another thread is that it doesn't matter if you are using something like rust. Wasm downgrades rust memory safety "guarantees" because those guarantees are only truly enforced by the operating
133.
by eyberg 3y ago
No. I think you are conflating the issues here. In this case we aren't talking about changing some code in a .js file through a RFI attack. We are talking about changing the behavior of how the node.js interpreter would run the .js fil
134.
by eyberg 3y ago
Ok. What is your solution then? If it is 'use rust' wasm actively downgrades the memory safety that rust gives you because many of the security issues that wasm has is a function of both the compiler and the operating system wor
135.
by eyberg 3y ago
So it is cool if you allow an attacker to change the program inside? Not cool. We were doing this back in the 90s.
136.
by eyberg 3y ago
This isn't about escaping the vm. It is about changing how the program works inside. Wasm also does not have the concept of read only memory which is another massive security hole.
137.
by eyberg 3y ago
When running the same code on linux or anything else you segfault. It is a huge security issue and totally not the only one.
138.
by eyberg 3y ago
Might be a rhetorical question but are you on the cloud? If so what language, apps are you running? I'd encourage you to take a look at https://ops.city && see if that is something that would work well for your use-
139.
by eyberg 3y ago
If you want to join us in the peanut gallery, AWS originally "adapted" Google's crosvm for firecracker. gVisor, if not using hw-backed virtualization, has absolutely horrendous performance because of, amongst other things, pt
140.
Summer of Unikernels – Golden Gate Park BBQ(meetup.com)
2 points by eyberg 3y ago|0 comments
141.
by eyberg 3y ago
* firewalls - nanos.org is a go unikernel running on GCP and we punch holes for it to talk on https * security - nanos supports much of the same security you'll see on linux but provides more: aslr, no stack/heap exec, rodata no e
142.
by eyberg 3y ago
Wasm and unikernels are more complimentary than competitive. You could actually run wasm in something like wasmer or wasmtime wrapped inside Nanos wrapped inside Firecracker if you wanted to. I think as you point out where wasm can shine ar
143.
by eyberg 3y ago
There are definitely other projects that are <10ms but I'm not convinced that a fast boot time is something worth spending a ton of time on. Many languages and frameworks take seconds to boot regardless (jvm, python ml frameworks, r
144.
by eyberg 3y ago
There is a basic assumption that these applications are being deployed to the cloud such as AWS, GCP, Azure, etc. so your app is already using all of this regardless - you just don't manage it - the cloud vendors do. Unikernels ask the
145.
What Is Vsock and Why Use It with Unikernels?(nanovms.com)
33 points by eyberg 3y ago|22 comments
146.
by eyberg 3y ago
I think in correlation to your other comment is that there is the notion that all of this is done for you via the cloud thus you don't really need/want to do it yourself. If you do wish to deal with this yourself yes you need some
147.
by eyberg 3y ago
If there is no hypervisor involved we would consider that bare metal regardless of how automated the process of provisioning the system is (eg: packet.net, hetzner). However, if we use your example then one is still managing the install pro
148.
by eyberg 3y ago
The big difference is the hypervisor in this case is the public cloud which is not just multi-tenant but massively multi-tenant. That is the host and vmware and aws and everyone else did a really excellent job of abstracting the host away t
149.
by eyberg 3y ago
If you are comparing a bare metal system, indeed you might not see a lot of benefits. However, there is a basic assumption that these workloads are running in the cloud which means they are already virtualized and then when you compare agai
150.
by eyberg 3y ago
Definitely agree with the top part, however, I should note that, ops, the tool's, whole existence is to create disk images and upload them to any cloud, any hypervisor. In particular, both https://ops.city && https

More ›