13 ms·
why not just a docker container
by prairieroadent 2mo ago
why not just a docker container
- matheusmoreira 2mo agoBecause that means you are sharing kernel with the sandboxed agent. Virtualization presents an infinitely smaller attack surface.
- hwc 2mo agoIf there is any attack surface within a properly-configured container, that's a kernel bug, right?
- matheusmoreira 2mo agoProbably. If I remember correctly, containers on Linux are implemented using the kernel's namespaces. The same ones which became famous for the vulnerabilities they surfaced in previously unexercised code.
- croes 2mo agoThen use SmolVM
- matheusmoreira 2mo agoI'm already using virtdev, my own solution built on top of QEMU.