News for hackers. Stuff that matters.

A comment on Cloud Run – Newest member of our serverless compute stack. Parent comment

Re:Cloud Run – Newest member of our serverless compute stack by rcconf on Tuesday April 09, 2019 @01:10PM (#19616800)
Hello, I had a question about how Cloud Run handles security between containers being run on the cloud.

I assume my container runs alongside other containers on the same host, how do you prevent privilege escalation exploits?

[ Parent | on HN ]
Re:Cloud Run – Newest member of our serverless compute stack by mikehelmick on Tuesday April 09, 2019 @01:12PM (#19616832)
Cloud Run engineer here.

Containers are run in gVisor https://github.com/google/gvisor as the container sandbox.

[ Parent | on HN ]
Re:Cloud Run – Newest member of our serverless compute stack by wlhee on Tuesday April 09, 2019 @01:15PM (#19616876)
Cloud Run prevents privilege escalation by using gVisor as sandbox technology. Each container has its own isolated user-space kernel from the host.

(Disclaimer: I am Cloud Run dev)

[ Parent | on HN ]