[Kata-hypervisor] kata requirements for image formats and devices

Allison Randal allison at lohutok.net
Sat Aug 4 07:46:23 UTC 2018


On 06/09/2018 02:13 PM, Allison Randal wrote:> I've carved out one small
piece, because there seem to be several groups
> independently evaluating whether Rust makes sense in this context. This
> is the beginnings of a Rust library to interface with KVM, and could be
> used by any Rust hypervisor:
> 
> https://gitlab.com/preon/libkvm

By way of an update, my research has led me to the conclusion that
virtual machines aren't the best approach for secure container
isolation. The problem isn't only that the current implementations are
slow and bloated (which is what I was working on), it's also that
virtual machines aren't really very secure.

So, I've mostly stopped work on libkvm, though I may use it for
low-level security and performance comparisons to other approaches. From
what I understand, though, someone else has picked up the code I
released as open source and continued working on it, so you may get the
benefit of it anyway.

I'm still working on secure container isolation, as part of the broader
concept of "composable infrastructure", so I'll let you know if some
parts of my work end up being relevant to what you're doing. But, it
might not be relevant, since it is so different.

Allison



More information about the Kata-hypervisor mailing list