VMs in a container-centric world
summary
Containers escape by targeting kernel feature edges — one public case overwrote the host runC binary — so projects combine VMs and containers to regain isolation while keeping agility. Results: a compress-and-run benchmark is ~10.9s on bare host, ~12s inside the guest but ~23s when measured from the host, so VM overhead is real. Workarounds include paravirtualized virtio devices, cross VM in Rust (Crostini) with read-only VBD, and gVisor stub kernel plus qemu slimming, hotplug and kconfig-based builds.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:13INTRODUCTION
- 3:39CONTAINER OVERVIEW
- 9:34ENTER VMS
- 11:52ABSTRACTION=COST
- 13:39MITIGATION
- 14:40Minimal Kernel
- 15:37HOST/GUEST COMMUNICATION
- 17:12EXAMPLE: CHROMOS CROSTINI
- 20:11EXAMPLE: KATA CONTAINERS
- 21:02Optimised Kernel
- 23:49X86 KVM FEATURE PARITY
- 25:13QUESTIONS?
related talks
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
14mA kernel? In a Container? Explain Yourself!
47mContainer Security
25mOne Size Fits None: Lightweight Workload-Specialized Confidential Containers
34mTailor-Made Security: Building a Kubernetes Specific Hypervisor
18mKeynote: VM Security and Container Workflows, A Case Study
31mYour Containers Aren’t Alone: Demystifying Container Isolation
36mKata Containers: Hypervisor-Based Container Runtime