_ananos_

5 ms·

1.
Kata Containers 4.0.0 Brings You a New Rust Runtime(katacontainers.io)
3 points by _ananos_ 2mo ago|0 comments
2.
by _ananos_ 2mo ago
@bugsense Agreed on OS-level sandboxing -- the paper actually argues it is not a sandbox at all. If the host kernel is in the trust path, you have a weaker boundary, and it does nothing for the credential problem either. Our definition star
3.
by _ananos_ 2mo ago
Sandboxing for Agentic Execution: A whitepaper with our take on the definition of Sandboxing!
4.
ITScape (CVE-2026-46316): KVM/ARM64 VM escape(nofire.ai)
8 points by _ananos_ 3mo ago|1 comments
5.
by _ananos_ 3mo ago
CVE-2026-46316 ("ITScape"). Reported by Hyunwoo Kim (@v4bel). This post discusses the vulnerability and its mitigations at a conceptual level using already-public information: no gadget offsets, no heap-spray primitives beyond wha
6.
by _ananos_ 4mo ago
thanks @anenefan -- we'll have to figure out what's wrong with our SEO I guess..
7.
by _ananos_ 4mo ago
no ads on the website.
8.
Ask HN: Second time my post gets [dead] within a minute
2 points by _ananos_ 4mo ago|4 comments
9.
How many sandboxed pods can fit in a Pi?(nubificus.co.uk)
11 points by _ananos_ 4mo ago|2 comments
10.
by _ananos_ 6mo ago
wasn't familiar with proot -- with a quick look I think proot is a fancy chroot -- which, in turn, is kind of "the first step" for a generic container. to achieve the isolation that gvisor offers you would have to intercept s
11.
by _ananos_ 6mo ago
a number of reasons -- power budget, form factor, experimenting as a testbed for more "elaborate" setups (like robotics combined with a low-end TPU like the coral, or a jetson nano) consider that you can take advantage of all the
12.
by _ananos_ 6mo ago
well, jokes aside, what you're describing, is kind of what a "secure" (with many air/literal quotes) MCP/Agentic architecture looks like :D In this context we're experimenting with gvisor on various platforms,
13.
by _ananos_ 6mo ago
yeap -- compute would be nearly the same. I suspect you need some kind of I/O to make your compute useful (get input for the computation / produce output etc.) so, still, this would have a negative effect overall.
14.
by _ananos_ 6mo ago
the simplest one (and the one we're targetting) is multi-tenant services. You want to sandbox your service so that it doesn't affect the rest of the services running. <shameless plug> We're building a container runtime
15.
by _ananos_ 6mo ago
well, the tricky detail here (which we do not mention in the post, our bad) is that we got the raspbian config (cp /boot/config ... .config && make oldconfig) which includes most modules, and that's why it took more.
16.
by _ananos_ 6mo ago
thanks, good to know!
17.
by _ananos_ 6mo ago
indeed! thanks for that. Could it be a malformed SEO/robots whatever these things are called from our website?
18.
by _ananos_ 6mo ago
thanks for your comment & suggestion! I'll drop the HN admins an email to make sure I'm not missing anything.
19.
Ask HN: Uploaded a post and it was [dead] within a minute
4 points by _ananos_ 6mo ago|8 comments
20.
Gvisor on Raspbian(nubificus.co.uk)
76 points by _ananos_ 6mo ago|17 comments
21.
by _ananos_ 7mo ago
data corruption, since fsync on the host is essentially a noop. The VM fs thinks data is persistent on disk, but it’s not - the pod running on the VM thinks the same …
22.
by _ananos_ 7mo ago
well, indeed -- we should have found the proper parameters to make etcd wait for quorum (again, I'm stressing that it's a single node cluster -- banging my head to understand who else needs to coordinate with the single node ...)
23.
by _ananos_ 7mo ago
well, the actual issue (IMHO) is that this meta-orchestrator (karmada) needs quorum even for a single node cluster. The purpose of the demo wasn't to show consistency, but to describe the policy-driven decision/mechanism. What hit
24.
Keeping our GH runners alive with dependabot(nubis-pc.eu)
2 points by _ananos_ 7mo ago|0 comments
25.
When etcd crashes, check your disks first(nubificus.co.uk)
45 points by _ananos_ 7mo ago|15 comments
26.
AI Agents? Not on my host(blog.cloudkernels.net)
10 points by _ananos_ 7mo ago|0 comments
27.
by _ananos_ 3y ago
https://gvisor.dev/docs/architecture_guide/performance/#star... should be pretty close, according to the numbers reported in the official docs. Essentially, it depends on what the workload does.
28.
Sandboxing user code in Knative with kata containers, gvisor, and unikernels(blog.cloudkernels.net)
5 points by _ananos_ 3y ago|2 comments
29.
by _ananos_ 6y ago
indeed! virtio helps us tailor the transport layer to an acceleration use-case, rather than just frames to be transmitted or blocks to be completed. The interesting turn on vAccelRT (of the runtime system that is) is that apart from the sim
30.
by _ananos_ 6y ago
the virtio-accel frontend is a kernel module. The backend is VMM specific, so there is one for QEMU and one for AWS Firecracker. Check out https://blog.cloudkernels.net/posts/vaccel_v2/ to give it a try and let us

More ›