ayush_ranjan

5 ms·

1. 1.▲
   Safe Ride into the Dangerzone: Reducing Attack Surface with GVisor(dangerzone.rocks)

   6 points by ayush_ranjan 2y ago|0 comments
2. 2.▲
   by ayush_ranjan 3y ago

   Author of the blog here. Point taken. In retrospect, directfs is not a good name as it gives the impression of a new filesystem implemention. I should have named this more along the lines of "direct access mode" as some of you hav
3. 3.▲
   by ayush_ranjan 3y ago

   > The old model howevwr was that read and write were translated to rpc calls to the broker. In the old model, reads/writes were not translated to RPCs. Only for regular files, the broker was donating FDs to the sentry (userspace ker
4. 4.▲
   by ayush_ranjan 3y ago

   gVisor recently rolled out a filesystem optimization which substantially improves filesystem performance for sandboxed workloads. It involves setting up a overlayfs mount for the container root filesystem in gVisor's user-space kernel
5. 5.▲
   gVisor improves filesystem performance using rootfs overlay(opensource.googleblog.com)

   5 points by ayush_ranjan 3y ago|1 comments