Show HN: Launch VM workloads securely and instantaneously, without VMs

Re:Show HN: Launch VM workloads securely and instantaneously... by riyakhanna1983 on Thursday April 29, 2021 @04:57AM (#26978838)

Thanks! gVisor intercepts app syscalls and serve them in user space (inside separate VMs, one for each container), which reduces runtime performance significantly. Both Firecracker and gVisor use VMs to sandbox container code.

Kwarantine, on the other hand, directly runs container code on the hardware (no VMs). It uses MMU/page tables to provide a different kernel to each container.

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by bem on Thursday April 29, 2021 @06:13AM (#26979321)

Makes sense. Why do you think Google and Amazon didn't pursue that approach for services like Cloud Functions and Lambda? Is there a trade-off or is it a matter of complexity?

[ Parent | on HN ]

Re:Show HN: Launch VM workloads securely and instantaneously... by ashishbijlani on Thursday April 29, 2021 @10:07AM (#26981340)

I believe they are constantly working on optimizing their infrastructure, and we will see improved versions of gVisor and Firecracker soon.

[ Parent | on HN ]