On 06/09/2018 02:13 PM, Allison Randal wrote:> I've carved out one small piece, because there seem to be several groups
independently evaluating whether Rust makes sense in this context. This is the beginnings of a Rust library to interface with KVM, and could be used by any Rust hypervisor:
By way of an update, my research has led me to the conclusion that virtual machines aren't the best approach for secure container isolation. The problem isn't only that the current implementations are slow and bloated (which is what I was working on), it's also that virtual machines aren't really very secure.
So, I've mostly stopped work on libkvm, though I may use it for low-level security and performance comparisons to other approaches. From what I understand, though, someone else has picked up the code I released as open source and continued working on it, so you may get the benefit of it anyway.
I'm still working on secure container isolation, as part of the broader concept of "composable infrastructure", so I'll let you know if some parts of my work end up being relevant to what you're doing. But, it might not be relevant, since it is so different.