Show HN: Launch VM workloads securely and instantaneously, without VMs

Posted by ashishbijlani on Wednesday April 28, 2021 @09:50PM
from the show-hn dept.

Hello HN! We've been working on a new hypervisor https://kwarantine.xyz that can run strongly isolated containers. This is still a WIP, but we wanted to give the community an idea about our approach, its benefits, and various use cases it unlocks. Today, VMs are used to host containers, and make up for the lack of strong security as well as kernel isolation in containers. This work adds this missing security piece in containers. We plan on launching a free private beta soon. Meanwhile, we'd deeply appreciate any feedback, and happy to answer any questions here or on our slack channel. Thanks!

( 8 comments | 12 points | on HN )

Re:Show HN: Launch VM workloads securely and instantaneously... by bem on Thursday April 29, 2021 @03:09AM (#26978238)

Looks interesting! I’ve been looking at setting up gVisor to enable running users’ code. How does/will Kwarantine compare to gVisor?

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by riyakhanna1983 on Thursday April 29, 2021 @04:57AM (#26978838)

Thanks! gVisor intercepts app syscalls and serve them in user space (inside separate VMs, one for each container), which reduces runtime performance significantly. Both Firecracker and gVisor use VMs to sandbox container code.

Kwarantine, on the other hand, directly runs container code on the hardware (no VMs). It uses MMU/page tables to provide a different kernel to each container.

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by bem on Thursday April 29, 2021 @06:13AM (#26979321)

Makes sense. Why do you think Google and Amazon didn't pursue that approach for services like Cloud Functions and Lambda? Is there a trade-off or is it a matter of complexity?

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by ashishbijlani on Thursday April 29, 2021 @10:07AM (#26981340)

I believe they are constantly working on optimizing their infrastructure, and we will see improved versions of gVisor and Firecracker soon.

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by ashishbijlani on Thursday April 29, 2021 @12:17AM (#26977420)

Posting direct link here for convenience: https://kwarantine.xyz

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by adithyasrin on Thursday April 29, 2021 @06:28AM (#26979399)

Looks interesting! For some reason, .xyz has a slightly non trustable signal for me

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by elijahwright on Thursday April 29, 2021 @10:52AM (#26981911)

How is this different than the Xen approach?

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by ashishbijlani on Thursday April 29, 2021 @11:05AM (#26982101)

Xen is a full-fledged hypervisor that hosts VMs. It uses QEMU for I/O emulation in VMs, which increases the attack surface.

Kwarantine is a thin hypervisor that hosts containers. It uses hardware virtualization extensions, MMU, and page tables to provide the same level of security as VMs. Each container runs with a separate copy of the host kernel so that vulnerabilities/bugs are isolated. It does not use QEMU.

[ Parent | on HN ]