5 ms·
Containers do not provide sufficient isolation to run untrused binaries. That's why aws built and uses firecracker for lambda.
by ledgerdev 4y ago
Containers do not provide sufficient isolation to run untrused binaries. That's why aws built and uses firecracker for lambda.
- ori_b 4y agoVMs are also full of side channels. Depending on how much isolation is a concern, you need to own the host. I don't trust VMs particularly more than containers in this respect: Containers have a lot of attack surface, but VMs also have a lot of complicated in the code in the kernel, in addition to having complicated emulated device drivers and a large silicon-based attack surface.