[Kata-hypervisor] kata requirements for image formats and devices

Dr. David Alan Gilbert dgilbert at redhat.com
Mon Aug 6 10:01:20 UTC 2018


* Allison Randal (allison at lohutok.net) wrote:
> On 06/09/2018 02:13 PM, Allison Randal wrote:> I've carved out one small
> piece, because there seem to be several groups
> > independently evaluating whether Rust makes sense in this context. This
> > is the beginnings of a Rust library to interface with KVM, and could be
> > used by any Rust hypervisor:
> > 
> > https://gitlab.com/preon/libkvm
> 
> By way of an update, my research has led me to the conclusion that
> virtual machines aren't the best approach for secure container
> isolation. The problem isn't only that the current implementations are
> slow and bloated (which is what I was working on), it's also that
> virtual machines aren't really very secure.

Can I ask you what your main security worries with them are?

Dave

> So, I've mostly stopped work on libkvm, though I may use it for
> low-level security and performance comparisons to other approaches. From
> what I understand, though, someone else has picked up the code I
> released as open source and continued working on it, so you may get the
> benefit of it anyway.
> 
> I'm still working on secure container isolation, as part of the broader
> concept of "composable infrastructure", so I'll let you know if some
> parts of my work end up being relevant to what you're doing. But, it
> might not be relevant, since it is so different.
> 
> Allison
> 
> _______________________________________________
> Kata-hypervisor mailing list
> Kata-hypervisor at lists.katacontainers.io
> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-hypervisor
--
Dr. David Alan Gilbert / dgilbert at redhat.com / Manchester, UK



More information about the Kata-hypervisor mailing list