News for hackers. Stuff that matters.
Re:Hyperlight: Virtual machine-based security for functions ... by generalizations on Thursday November 07, 2024 @02:01PM (#42079711)
> These micro VMs operate without a kernel or operating system, keeping overhead low. Instead, guests are built specifically for Hyperlight using the Hyperlight Guest library, which provides a controlled set of APIs that facilitate interaction between host and guest

Sounds like this is closer to a chroot/unikernel than a "micro VM" - a slightly more firewalled chroot without most of the os libs, or a unikernel without the kernel. Pretty sure it's not a "virtual machine" though.

Only pointing this out because these sorts of containers/unikernels/vms exist on a spectrum, and each type carries its own strengths and limitations; calling this by the wrong name associates it with the wrong set of tradeoffs.

Re:Hyperlight: Virtual machine-based security for functions ... by wmf on Thursday November 07, 2024 @02:30PM (#42079997)
I guess if it uses CR3 it's a "process" and if it uses VMLAUNCH it's a "VM".
Re:Hyperlight: Virtual machine-based security for functions ... by generalizations on Thursday November 07, 2024 @02:48PM (#42080179)
Heh. Going by that delineation we end up with very VM-ish containers and (now) very container-ish VMs. Though this seems like it's even more stripped down than a unikernel - which would also be a "VM" here.
Re:Hyperlight: Virtual machine-based security for functions ... by 0cf8612b2e1e on Thursday November 07, 2024 @02:37PM (#42080069)
I thought a chroot was not considered a real security boundary?
Re:Hyperlight: Virtual machine-based security for functions ... by ronsor on Thursday November 07, 2024 @05:53PM (#42082015)
Chroot is a real security boundary as long as you use it properly. That said, namespaces on Linux are much superior at this point, so I can only recommend using `chroot` for POSIX compliance.
Re:Hyperlight: Virtual machine-based security for functions ... by derefr on Thursday November 07, 2024 @08:54PM (#42083337)
chroot is great for all sorts of things, but they're not security-related.

A lot of tools expect to do things to "your system" at absolute paths — chroot lets those tools operate against an explicitly wired-up semi-virtualized simulacra of your system, designed to pass through just the parts of those operations you want to your real host, while routing the rest of the effects into a "rootfs in a can", that you're either building up, or will immediately throw away.

Think: debootstrap; or pivot-root; or mounting your rootfs to fix your GRUB config and re-run update-grub from your initramfs rescue shell.

Re:Hyperlight: Virtual machine-based security for functions ... by kevincox on Sunday November 10, 2024 @06:36AM (#42099671)
Yes. Anything that shares a kernel is a very weak security boundary as the kernel is complex and vulnerabilities are regularly discovered.
Re:Hyperlight: Virtual machine-based security for functions ... by 0x457 on Thursday November 14, 2024 @07:38PM (#42142876)
Okay, so every name in this post makes sense it's just some of these words started to mean very different things with time.

This is not a hypervisor or a vm manager. It's a library that lets you run a C or Rust function[1] inside a VM managed by platform hypervisor[2].

[1]: As in Function (computer programming) not a AWS Lambda.

[2]: KVM or mshv on Linux and Windows Hypervisor on linux