Ask HN: Best container runtime for process isolation / security?

9 points by capableweb 5y ago ↗ HN

I'm currently considering a project where containers could be used to quickly spin up resources. Trick is, one user would "own" one container, meaning that isolation between containers and isolation between the host/container is important.

Most runtimes I've looked at, don't really offer anything in terms of security isolation, and also don't make a lot of guarantees. Seems I'll end up using VMs so I can get proper isolation.

But maybe I've missed something, and you people here know any good solution for this.

Point is to have fast startup time of the container/VM and also good isolation between the containers/VMs themselves, and between the container/host.

This is all supposed to run on self-hosted infrastructure and without Kubernetes et all, so Lambda and all "container-as-a-service" things are N/A

6 comments

[ 3.2 ms ] story [ 21.3 ms ] thread

gtirloni 5y ago ↗

Looks like you want this: https://firecracker-microvm.github.io/

capableweb 5y ago ↗

Thanks! That looks interesting and I had missed it.

cpach 5y ago ↗

I highly recommend reading through Fly’s blog posts. They let customers build Docker images, which are then transformed to Firecracker VMs. Very cool!

https://fly.io/blog/docker-without-docker/

helixc 5y ago ↗

Exactly what I'm looking for. Waiting for more insights.

kasey_junk 5y ago ↗

I’m not making a claim about its quality but gvisor is another isolation focused runtime https://github.com/google/gvisor

yamellasmallela 5y ago ↗

firecracker is probably what you need that literally runs lambda

gvisor is also good for pure container runtimes