Remote Code Execution as a Service

Re:Remote Code Execution as a Service by preseinger on Tuesday March 07, 2023 @09:14PM (#35064346)

if your security model assumes user code is able to break out of containers, then it also has to assume user code will be able to modify the VM

if user code can modify the VM, and VMs are stateful, then how do you ensure hermetic builds?

[ Parent | on HN ]

Re:Remote Code Execution as a Service by adamgordonbell on Wednesday March 08, 2023 @06:56AM (#35067934)

So the builds are specified in Earthfiles, which are run by our buildkit backend.

Buildkit runs the builds in runC, so basically containers are used to keep things deterministic, but the buildkit backend isn't shared, each is in own EC2 instance.

So if you could break out or access cache entries that weren't correct you would have found a way to break reproducibility, but not access anything you shouldn't.

[ Parent | on HN ]

Re:Remote Code Execution as a Service by preseinger on Wednesday March 08, 2023 @12:48PM (#35072215)

ah, okay, so you're using containers, you're running those containers on VMs that are per-customer rather than shared/multi-tenant, and the post is about optimizing how those VMs are managed -- got it

> but the buildkit backend isn't shared, each is in own EC2 instance

it isn't shared between different customers, but it is shared between different builds for the same customer, right?

[ Parent | on HN ]