Katakate: Dozens of VMs per node for safe code exec: K8s+Kata+Firecracker

Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by elric on Tuesday October 21, 2025 @02:19PM (#45659517)

Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.

[ Parent | on HN ]

Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by gbxk on Tuesday October 21, 2025 @02:25PM (#45659610)

That's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.

[ Parent | on HN ]

Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by ATechGuy on Tuesday October 21, 2025 @02:34PM (#45659728)

Side-channel attacks apply to multi-tenant cloud environments, not local.

[ Parent | on HN ]

Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by elric on Tuesday October 21, 2025 @03:03PM (#45660139)

That seems like a naive take. If any of your local VMs are internet connected and are compromised, side channel attacks could be used to exfiltrate data from other VMs or the host.

[ Parent | on HN ]

Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by ATechGuy on Tuesday October 21, 2025 @03:32PM (#45660552)

Then why only apply to VMs, why not apps?

[ Parent | on HN ]