News for hackers. Stuff that matters.

A comment on Ask HN: Pros and cons of V8 isolates?. Parent comment

Re:Ask HN: Pros and cons of V8 isolates? by tptacek on Wednesday June 15, 2022 @08:37PM (#31761231)
"In kernel with apparmor or SELinux" can't possibly provide sufficient workload isolation, because it implies workloads share a kernel. It's easy to rattle off relatively recent kernel LPEs that no mandatory access control configuration would have prevented.

The Linux kernel simply wasn't designed to provide the kind of isolation "naive" containers want them to. Actually, generalize that out: Unix kernels in general weren't designed this way. It just doesn't work.

[ Parent | on HN ]
Re:Ask HN: Pros and cons of V8 isolates? by ignoramous on Thursday June 16, 2022 @01:13AM (#31762629)
End game then is LittleKernel/Zircon on Fly.io? When do we get to play with those?
[ Parent | on HN ]
Re:Ask HN: Pros and cons of V8 isolates? by willsher on Thursday June 16, 2022 @02:14AM (#31762935)
Whether software based access control is sufficient depends on the workload and where in the stack the workload runs. I agree though, hardware virtualisation based is more secure and less complex. It also requires access to bare metal, so a providers service or run it yourself, which is a trade off.
[ Parent | on HN ]