eyberg

16 ms·

181.
by eyberg 4y ago
This is a very common misunderstanding in how these actually get deployed in real life. Disclosure: I work with the OPS/Nanos toolchain so work with people that deploy unikernels in production. When we deploy them to AWS/GCP/
182.
by eyberg 4y ago
Worth noting that loading a small hello world c unikernel can load in a ridiculous small amount of time but some multiple-gigabyte JVM unikernel might take 100s of ms. If you need super fast boot times firecracker is definitely worth lookin
183.
by eyberg 4y ago
I'm completely biased as I work on the nanos/ops unikernel toolchain but unikernels offer a very PaaS like feel as the app and server become one. You simply build your image (ops image create) and then deploy it (ops instance crea
184.
by eyberg 4y ago
This was first published in 1978. We didn't have commoditized SMP machines until late 90s, early 2000s. Similarly, we didn't have 'good' threads until the early 2000s. In fact if you were coding in the 90s and early 00s
185.
by eyberg 4y ago
I don't know if marketing was involved with using the term 'isolate' or not but if they are isolates as described by companies such as Cloudflare and Google, it might help to speak a bit more about the actual implementation a
186.
Sending memory metrics to Amazon CloudWatch(nanovms.com)
1 points by eyberg 4y ago|0 comments
187.
by eyberg 4y ago
We don't think that's a defining characteristic no. We keep the kernel/user cause otherwise you can very very easily change page permissions which means all security goes out the window. You could instantly make rwx on all pa
188.
by eyberg 4y ago
Right here. https://nanovms.com If you like kernel level c I'm hiring. The best hackers want to work with the best hackers and we are charting a new course for the 2020s - not one from the 1960s. Despite what you might read
189.
Wiz Research discovers “ExtraReplica” a cross-account db vuln in Azure Postgre(wiz.io)
5 points by eyberg 4y ago|0 comments
190.
Closures in the Nanos Unikernel(nanovms.com)
1 points by eyberg 5y ago|0 comments
191.
Cr8escape: Zero-day in CRI-O Container Engine (CVE-2022-0811)(crowdstrike.com)
4 points by eyberg 5y ago|0 comments
192.
Running Nanos on AWS Graviton(nanovms.com)
2 points by eyberg 5y ago|0 comments
193.
by eyberg 5y ago
I'm not sure anyone would advocate the application to monitor itself. Many companies have entire teams of people that have to deal with keeping machines up and they get paid big bucks to do so. As for the IDS question/statement -
194.
by eyberg 5y ago
The Hurd is actually older than Linux now at a ripe age of 32, although I think it was Mendel Rosenblaum that said "hypervisors/machine monitors were microkernels done right". https://www.usenix.org/legacy&#x2
195.
by eyberg 5y ago
Nanos supports multiple threads but not multiple processes so you can have as much performance as you have underlying hardware but if you are using something like an interpreted language where is normal to spin up X app-workers behind a rev
196.
by eyberg 5y ago
It depends. A t2.nano has 512mb of memory. If you are using Go or something like that you could go much lower but any runtime environment such as ruby/python/node are going to want a minimum of a few hundred meg. If you are using
197.
by eyberg 5y ago
Using redis as an example it's basically half in every benchmark: https://gvisor.dev/docs/architecture_guide/performance/#syst... IO bound tasks can be up to 10x slower using ptrace. I think using hardwa
198.
by eyberg 5y ago
I agree with most of this except for the monitoring/debugging part. GDB works great as does printf and others: https://docs.ops.city/ops/debugging Prometheus and other open source monitoring solutions work out of
199.
by eyberg 5y ago
There are benefits to this if you are deploying something like a 5G microservice or some other single-purpose, small binary that takes few resources but at the end of the day if you are deploying a JVM application that is gigabytes in size
200.
by eyberg 5y ago
The difference is that the vast majority of people are deploying to the cloud so they are already deploying to a hypervisor. Every single cloud is built on top of virtualization. AWS used to use Xen, now they use KVM. Google Cloud is entire
201.
by eyberg 5y ago
This is very very common misconception. Just yesterday I was helping someone out with a networking issue they were having on AWS stemming from this concept. Coming from k8s/firecracker it is common to think that you need to orchestrate
202.
by eyberg 5y ago
In gVisor if you aren't using hardware acceleration (eg: virtualization) then you are using ptrace which is incredibly slow.
203.
Nanos on the 64-bit RISC-V Architecture(nanovms.com)
1 points by eyberg 5y ago|0 comments
204.
by eyberg 5y ago
It doesn't matter if it's rust or not. You can still modify read only data and still redirect indirect calls. You can still modify the stack and the heap. Rust changes nothing. Also, not sure where the comparison to a hypervisor i
205.
by eyberg 5y ago
It is trivial to modify function pointers, implemented as indirect calls and "read-only" data in wasm.
206.
by eyberg 5y ago
I'll ask the same questions I had over on lobsters since I didn't get satisfactory answers there: * 64bit - Can I run a database that addresses more than 4 gig of memory (eg: keep all my indices in memory so perf doesn't fall
207.
by eyberg 5y ago
We've seen boot times in the 60s and 70s of ms but have put absolutely no work into optimizing that. We could drive that down substantially for payloads like virtual network functions. I should point out that boot time is highly depend
208.
by eyberg 5y ago
There are several pre-built JVM packages and VBox and OCI works.
209.
by eyberg 5y ago
You can also build from source here: https://github.com/nanovms/nanos && https://github.com/nanovms/ops . There are also packages available through AUR/homebrew and the like: https:&
210.
by eyberg 5y ago
Nope. Appreciate the feedback. The community site could definitely use massive amounts of documentation and it hasn't been updated recently either. I'd agree anyone that is actually taking something to prod will be using a ci&#x2F

More ›