TinyKVM: Fast sandbox that runs on top of Varnish

Re:TinyKVM: Fast sandbox that runs on top of Varnish by cryptonector on Friday March 14, 2025 @11:59AM (#43363907)

I mean you don't get to open files, sockets, devices, etc. in the sandboxed program. You get to do just a few minimal things like I/O on stdin/stdout/stderr, use shared memory, maybe allocate memory.

[ Parent | on HN ]

Re:TinyKVM: Fast sandbox that runs on top of Varnish by winternewt on Sunday March 16, 2025 @03:17PM (#43381395)

So how do you do I/O on stdin/stdiout/stderr without syscalls?

[ Parent | on HN ]

Re:TinyKVM: Fast sandbox that runs on top of Varnish by cryptonector on Tuesday March 18, 2025 @04:08PM (#43404403)

There's a tiny kernel, and there are syscalls, because after all the executable is -though ELF- a statically linked executable with a statically linked libc, but that mini kernel only handles very few system calls, and does not provide the full generality of Linux. Yes I shouldn't have said "there's no syscalls", just no generic I/O.

[ Parent | on HN ]