Re:Truly elastic clouds with Zerg: OS-less Erlang on Xen
by rwmj on Sunday March 24, 2013 @06:40AM
(#5431660)
For the first case, I'd rather use something like Google Native Client.
The attack surface of a VM is rather large, particularly when you consider the dozens of emulated devices and instructions. For example, there was a notable hole in SCSI emulation recently discovered which let any guest overwrite any part of a host's disk (by sending some obscure SCSI commands which weren't being filtered by the virtualized device properly).
Re:Truly elastic clouds with Zerg: OS-less Erlang on Xen
by e12e on Sunday March 24, 2013 @12:00PM
(#5432406)
> For the first case, I'd rather use something like Google Native Client.
Wait, you're saying Google NaCl could be going the way of Java -- being used for server side containers, rather than client side apps? (I don't really see why you'd want that over using a single process(tree)/binary compiled from go...).
Re:Truly elastic clouds with Zerg: OS-less Erlang on Xen
by e12e on Sunday March 24, 2013 @12:20PM
(#5432476)
Oh, I see. Zerovm[1,2] is built on top of NaCl, and does indeed appear to be a "javaosification" of NaCl -- with no bytecode, no dedicated language, but a sandbox/lockdown of native code.
[1] https://news.ycombinator.com/item?id=3746222 [2] http://zerovm.org
There are two situations where running applications directly on the hypervisor might be beneficial though:
- If you have to run multiple untrusted (and possibly malicious) tasks on same host. In this case virtualization provides better isolation/security than just containers or processes (which would be vulnerable to kernel exploits, or other ways of gaining root inside a container allows to take control of the host)
- If the hypervisor is fixed and you can't touch it (i.e. Amazon EC2). In this case running applications directly on the hypervisor might eliminate some of the virtualization overhead.