Thread

1. eranation · 1791057877 · focus · HN ↗

   Daily reminder that containers are not considered a safe security boundary, and never were. If you really need to run untrusted code, use a MicroVM.

   1. TheRoque · 1791061693 · focus · HN ↗

      What microVM do you recommend ?

      1. asa123 · 1791065393 · focus · HN ↗

         not op but firecracker exists, as does docker sbx (not container!),

         firecracker is a lot more of a headache to setup than docker sbx (not container!) but if you can get it going it probably “feels” the best

         of a different variety some people feel better using stuff like bubblewrap/fire jail but idk if these are still microvm as opposed to the above

         but it’s my opinion (perhaps completely criticizable), that sandboxing for personal home use machines is 1) somewhat overkill 2) somewhat theatre 3) psychologically sometimes exhausting and unrealistic always assuming the worst is going to happen and 4) not really worth the time and creates quite a bit of friction that there wasn’t previously. In the end I spent more time tinkering with the sandbox to get it “just” right that it drained my time actually using the agents so …

         1. eranation · 1791137392 · focus · HN ↗

            What about gVisor and/or container-sandbox + Kata + cloud-hypervisor
   2. yaitio · 1791068085 · focus · HN ↗

      [dead]

   3. zenoprax · 1791072226 · focus · HN ↗

      It depends on your threat model but I think it&#x27;s a good reminder either way. I recently discovered SmolVM &lt;<a href="https:&#x2F;&#x2F;github.com&#x2F;smol-machines&#x2F;smolvm" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;smol-machines&#x2F;smolvm&gt; and it looks like a pretty good sweet spot for usability and isolation. There are so many sandboxing technologies to pick from and understand.

      I&#x27;ve been using (rootless) Podman which gives me some basic assurances that it will stay in its designated directory and not run tools on my system directly but I have no limits on the network and with an internal UID&#x2F;GID of 0:0 I have not done myself any favours. This is the same level of protection one would implement to keep a poorly written bash script from wreaking havoc and that&#x27;s about it.

      1. binsquare · 1791074574 · focus · HN ↗

         thanks! author of smolvm here.

         I focus on being the batteries-included approach for microVMs. So network is off by default, and you can allow specific hosts (DNS is filtered too), so an agent can reach its model API and nothing else.

         And then I also put a lot of work in the jailer-style hardening around the VMM process itself: seccomp allowlist, Landlock, separate unprivileged uid per VM, and cgroup limits.

         So that users have security &amp; knobs right out of the box.

         fwiw i used to operate an AWS service using firecracker.

      2. eranation · 1791137378 · focus · HN ↗

         What about gVisor and&#x2F;or container-sandbox + Kata + cloud-hypervisor?

         1. zenoprax · 1791144064 · focus · HN ↗

            I looked into kata but it doesn&#x27;t support Podman (my preferred baseline). I assume that touching a kernel requires some sort of rootful interface but I don&#x27;t know enough about how seccomp and the other layers interact to know if it&#x27;s the right balance.

            gVisor felt a bit more &quot;hacky&quot; initially (at least compared to krun) but I will look into it a bit more as I saw someone else integrating it into their own setup.

            My goal is to get 80% of the isolation for 20% inconvenience. Right now it feels like I&#x27;m getting 30-50% isolation for 10% inconvenience — I&#x27;m willing to tolerate a bit more friction if I can get a bigger jump in security.

Unofficial Hacker News client; not affiliated with Y Combinator.