Re:New for AWS Lambda – Container Image Support
by mwcampbell on Tuesday December 01, 2020 @04:30PM
(#25270187)
I do have a question. I know that Lambda normally reuses a running container for multiple consecutive function invocations. What if I don't want to do that for a particular function? Suppose, for security, I don't want any leftovers from a previous invocation (in case it had data from a different user). Is there a way I could gracefully tell Lambda to create a fresh container instance for each invocation, and just live with the cold start penalty every time? Edit: I could just look to Fargate at this point, but it sounds like Lambda is doing some extra cold start optimization.
[ Parent
| on HN ]
Re:New for AWS Lambda – Container Image Support
by munns on Tuesday December 01, 2020 @04:35PM
(#25270255)
No good way to do this today. You are right in that you'd be forcing cold-starts. You could use a Lambda Extension to provide some sort of after-processing clean up of vars or /tmp space.. but thats hypothetical I haven't seen anyone do that yet.
Re:New for AWS Lambda – Container Image Support
by mwcampbell on Tuesday December 01, 2020 @04:42PM
(#25270334)
I think what I'll do is write a container entry point that cleans up temporary files like you said, but also repeatedly spawns a new process for the main program, to minimize the findable leftover data in RAM. Just in case an attacker finds a Heartbleed equivalent in my application.
Thanks again!
Re:New for AWS Lambda – Container Image Support
by mikeparker2 on Tuesday December 01, 2020 @08:11PM
(#25272173)
Just a heads up we're trying to do that with Fargate right now and theres a limit to how quickly fargate can spin up new instances (like max 10 at a time); it's not well designed to do a single-execution-per-message right now, at least at a decent load.