Hacker News new | past | comments | ask | show | jobs | submit
asdfsa32 | on: Greg Kurtzer's Ginux is now a userspace kernel
This is kind of the wrong approach when linux namespaces exist and rootless namespaces are approach full spectrum.
weinzierl | parent | next
The Linux kernel is a gigantic attack surface with a ton of legacy stuff most modern applications will never need. Namespaces do not really help with this, but userspace kernels can. (Haven't looked into Ginux enough to know if it does.)

That is also why I believe the namespace approach, and by extension Docker-like containerization, is a dead end when it comes to isolation. I hope something like gVisor will win.

This is even more important since agents have turned isolation from a datacenter topic into everyone's concern.

loading story #50451432
stingraycharles | parent | next
I’m still fascinated by the approach, though. It seems to me that it sits somewhere between cgroups and virtual machines.

I do wonder what problem it solves, as I don’t think that it provides the same security guarantees that micro-VMs like firecracker do?

eddythompson80 | root | parent | next
It’s the same approach as gVisor. Fairly decent isolation if your application can work on it, but your SOL if a scenario comes up that doesn’t work. VMs give you pretty much 100% Linux compatibility at the expense of density, optimal resource allocation and startup time. gVisor gives you excellent startup time, resource allocation and density at the expense of some app compat and performance at the extremes

Edit: at least with gvisor you get close to a decade of work on compat. gVisor can support some rootless containers scenarios and systemd these days.

mbreese | root | parent | next
I’d be very interested in it if it started to approach VM style isolation without needing KVM access (or qemu).

But I’m not sure if that is really possible.

The use case I’m thinking about is a sandbox exec isolation on an HPC cluster without Docker. I know singularity/apptainer exist, but I’m always looking for something that could make that environment more flexible. It is a tight security environment, so we are always limited in what we can do.

loading story #50450623
photios | root | parent | next
I wonder if this can grow into a capability-based security tool.
Pawenniag | parent | next
Rootless namespaces are getting better, but they don't eliminate the host kernel attack surface
loading story #50452226
nessex | parent | next
Isn't this also adding a capability sort of like OpenBSD's pledge?
worthless-trash | parent | next
If it has to go through another layer , hopefully without ring0 privs, which more than likely may filter out a number of exploit vectors, how is this the wrong approach ?

Breaking this layer doesn;t automatically give ring0 privs across the hardware.

photios | parent
> Telling someone's research and exploration is wrong...

Never change, HN, never change :D

asdfsa32 | root | parent
The project says:

> That research phase is complete.

So not sure what part of it now constitutes "research and exploration".