HN Explorer

Show HN: Launch VM workloads securely and instantaneously, without VMs

12 points by ashishbijlani ↗ HN
Hello HN! We've been working on a new hypervisor https://kwarantine.xyz that can run strongly isolated containers. This is still a WIP, but we wanted to give the community an idea about our approach, its benefits, and various use cases it unlocks. Today, VMs are used to host containers, and make up for the lack of strong security as well as kernel isolation in containers. This work adds this missing security piece in containers. We plan on launching a free private beta soon. Meanwhile, we'd deeply appreciate any feedback, and happy to answer any questions here or on our slack channel. Thanks!

8 comments

[ 2.1 ms ] story [ 31.0 ms ] thread
bem
Looks interesting! I’ve been looking at setting up gVisor to enable running users’ code. How does/will Kwarantine compare to gVisor?
riyakhanna1983
Thanks! gVisor intercepts app syscalls and serve them in user space (inside separate VMs, one for each container), which reduces runtime performance significantly. Both Firecracker and gVisor use VMs to sandbox container code.

Kwarantine, on the other hand, directly runs container code on the hardware (no VMs). It uses MMU/page tables to provide a different kernel to each container.

bem
Makes sense. Why do you think Google and Amazon didn't pursue that approach for services like Cloud Functions and Lambda? Is there a trade-off or is it a matter of complexity?
ashishbijlani
I believe they are constantly working on optimizing their infrastructure, and we will see improved versions of gVisor and Firecracker soon.
elijahwright
How is this different than the Xen approach?
ashishbijlani
Xen is a full-fledged hypervisor that hosts VMs. It uses QEMU for I/O emulation in VMs, which increases the attack surface.

Kwarantine is a thin hypervisor that hosts containers. It uses hardware virtualization extensions, MMU, and page tables to provide the same level of security as VMs. Each container runs with a separate copy of the host kernel so that vulnerabilities/bugs are isolated. It does not use QEMU.