News for hackers. Stuff that matters.

A comment on Katakate: Dozens of VMs per node for safe code exec: K8s+Kata+Firecracker. Parent comment

Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by gbxk on Tuesday October 21, 2025 @02:23PM (#45659581)
It is well known that containers do not provide you safe isolation. It is not their purpose. They share kernel and page cache with the host. Any kernel exploit gives to someone in a container potential root control of the host (see DirtyPipe, DirtyCow). That's why you need VM-level isolation.
[ Parent | on HN ]
Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by innanet-worker on Tuesday October 21, 2025 @07:02PM (#45662856)
today i'm one of the lucky 10k https://xkcd.com/1053/
[ Parent | on HN ]
Re:Katakate: Dozens of VMs per node for safe code exec: K8s+... by gbxk on Wednesday October 22, 2025 @05:14AM (#45666581)
Lucky you! And lucky me for sharing the info :)
[ Parent | on HN ]