My VM is lighter (and safer) than your container (2017)

Re:My VM is lighter (and safer) than your container (2017) by pojzon on Thursday September 08, 2022 @03:56PM (#32771176)

With eBPF there is really not much to argue about in security space.

You can do everything.

New toolset for containers covers pretty much every possible use-case you could even imagine.

The trend will continue in favor of containers and k8s.

[ Parent | on HN ]

Re:My VM is lighter (and safer) than your container (2017) by staticassertion on Thursday September 08, 2022 @04:49PM (#32771907)

I'm not sure what you mean with regards to eBPF but the difference between a container and a VM is massive with regards to security. Incidentally, my company just published a writeup about Firecracker: https://news.ycombinator.com/item?id=32767784

[ Parent | on HN ]

Re:My VM is lighter (and safer) than your container (2017) by evol262 on Thursday September 08, 2022 @04:46PM (#32771860)

Let me know when eBPF can probe into ring-1 hypercalls into a different kernel other than generically watching timing from vm_enter and vm_exit.

Yes, there is a difference between "eBPF can probe what is happening in L0 of the host kernel" and "you can probe what is happening in other kernels in privileged ring-1 calls".

No, this is not what you think it is.

[ Parent | on HN ]

Re:My VM is lighter (and safer) than your container (2017) by tptacek on Thursday September 08, 2022 @05:08PM (#32772107)

It is pretty obviously not the case that eBPF means shared-kernel containers are comparably as secure as VMs; there have been recent Linux kernel LPEs that no system call scrubbing BPF code would have caught, without specifically knowing about the bug first.

[ Parent | on HN ]