kang1

4 ms·

1. 1.▲
   by kang1 1y ago

   gvisor is difficult to implement in practice. it a syscall proxy rather than a virtualization mechanism (even thus it does have kvm calls). This causes a few issues: - the proxying can be slightly slower - its not a vm, so you cannot use th
2. 2.▲
   by kang1 1y ago

   not really, its just attack surface reduction
3. 3.▲
   by kang1 1y ago

   no ;) (though you could start it there if you wanted, but.. why) LD_PRELOAD simply loads a library of your choice that executes code in the process context, that's all. folks usually do this when they cannot recompile or change the run