Re:Open-sourcing gVisor, a sandboxed container runtime
by xtrapolate on Wednesday May 02, 2018 @09:54AM
(#16976852)
> "It rewrites the syscalls to make them succeed"
Imagine some applications expect the syscall to actually fail (ie. some odd way to test permissions).
I fail to grasp how this is a strength. Pulling the rug from under applications is dangerous. You're in a direct battle with internal implementation specifics - you don't want to get into that as an abstraction layer. You don't want to tailor various hacks for specific applications.
Imagine some applications expect the syscall to actually fail (ie. some odd way to test permissions).
I fail to grasp how this is a strength. Pulling the rug from under applications is dangerous. You're in a direct battle with internal implementation specifics - you don't want to get into that as an abstraction layer. You don't want to tailor various hacks for specific applications.