5 ms·
Did the BSD jails provide enough isolation? Would memory from a process truly be isolated from another? How about FD’s? Could there be side channel attacks? At
by sayhello 7y ago
Did the BSD jails provide enough isolation? Would memory from a process truly be isolated from another? How about FD’s?
Could there be side channel attacks? At what level?
Perhaps the whole kernel design needs to be revisited, which I assume is what’s being taken on by Fuchsia.
- braindeath 7y agoI’ve seen no evidence that Fuchsia is bringing much more than 90s era embedded OS design. Just because it’s not Linux doesn’t mean it’s new. Not that this is a bad thing, but someone please correct me if there is something fundamentally recent in Zircon.
- marios 7y agoThe BSD jails / Solaris zones approach is not the same at the path taken by Linux. Linux gives you a facility to isolate network, a facility to isolate process views etc. You put them all together and you get a "container". The former starts off by having a container primitive that can't do much because, well, it's contained from everything. You then proceed to give it access to the network, the filesystem.
- takeda 7y agoWhat do you mean? Isolating network and isolate processes view is what FreeBSD jail was always doing. The most common use of freebsd jails was providing VPS servers to users.