On 08/06/2018 11:01 AM, Dr. David Alan Gilbert wrote:
Can I ask you what your main security worries with them are?
Virtual machines were a pretty neat idea back in the day when security was just getting started on "Hey, now that we can run more than one process on the machine at the same time, maybe we shouldn't give every process complete and unrestricted control over the entire machine" (for example http://doi.acm.org/10.1145/800122.803961, from 1973). But, computer security has evolved in the past 60 years, and virtual machines haven't really kept up. There's plenty of research on how to make virtual machines more secure, but it isn't making its way into stable implementations. This is partly for the practical reason that it's time-consuming and expensive to update a large codebase, but it's also partly because the "improvements" often come with performance trade-offs that make virtual machines unusable. Just a few examples out of thousands: https://doi.org/10.1145/3193111.3193118 https://doi.org/10.1145/3134600.3134648 https://doi.org/10.1109/TDSC.2015.2429132 https://doi.org/10.1109/TIFS.2015.2505680 https://doi.org/10.1145/2517488.2517489 https://www.usenix.org/conference/atc17/technical-sessions/presentation/gopa... While containers aren't currently considered very secure either (e.g. https://doi.org/10.1109/i-Society.2016.7854163, https://doi.org/10.1145/3058060.3058085), the isolation that containers do provide is a collection of features added to more modern kernels (namespaces, cgroups, capabilities, seccomp, etc), in a modular approach that has allowed containers to more readily adopt existing advances in security, and also means containers can more easily pivot to incorporate new low-level security features that become available in the future. Which makes it interesting to explore low-level isolation features exposed directly to libcontainer (and similar). Doing secure isolation without virtualization isn't a radical new idea, the earliest work on capabilities for secure process isolation started several years before the first work on virtual machines (for some of the earliest history, see https://homes.cs.washington.edu/~levy/capabook/). There are a number of independent threads of research heading this direction in recent years, here are a few examples: https://www.usenix.org/conference/hotcloud18/presentation/williams https://doi.org/10.1145/3078861.3078882 https://doi.org/10.1145/3102980.3103008 https://doi.org/10.1145/3086567.3086572 https://doi.org/10.1109/DSN.2017.49 This isn't a criticism of the Kata project. In terms of what you can download and install in production today, virtual machines wrapped around containers are a reasonable option, and certainly fairly common practice. And, since Kata is an abstraction layer over hypervisor isolation, it could potentially evolve to use other forms of isolation in the future. Allison