gvisor VS containerd

If you think about it virtualization is just a narrowing of the application-kernel interface. In a standard setting the application has a wide kernel interface available to it with dozens (ex. seccomp) to 100's of syscalls. A vulnerablility in any one of which could result in complete system compromise.

With virtualization the attack surface is narrowed to pretty much just the virtualization interface.

The problem with current virtualization (or more specifically, the VMM's) is that it can be cumbersome, for example memory management is a serious annoyance. The kernel is built to hog memory for cache and etc. but you don't want the guest to be doing that - since you want to overcommit memory as guests will rarely use 100% of what is given to them (especially when the guest is just a jailed singular application), workarounds such as free page reporting and drop_caches hacks exist.

I would expect eventually to see high performance custom kernels for a application jails - for example: gVisor[1] acts as a syscall interceptor (and can use KVM too!) and a custom kernel. Or a modified linux kernel with patched pain points for the guest.

[1] <https://gvisor.dev/>

Hillai: Following our research, Alibaba took several steps to address the vulnerabilities we discovered. They limited image pull secret permissions to read-only access, preventing unauthorized uploads. Additionally, they implemented a secure container technology similar to Google's gVisor project. This technology hardens containers and makes them more difficult to escape from, adding another layer of security.

If you want to use netstack without Bazel, just use the go branch:

https://github.com/google/gvisor/tree/go

go get gvisor.dev/gvisor/pkg/tcpip@go

The go branch is auto generated with all of the generated code checked in.

Isn't gVisor kind of this as well?

"gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux."

https://github.com/google/gvisor

This sort of feels like seeing someone riding a bike and saying: why don’t they just get a car? The simple fact is that containers and VMs are quite different. Whether something uses VMX and friends or not is also a red herring, as gVisor also “rolls it own VMM” [1].

[1] https://github.com/google/gvisor/tree/master/pkg/sentry/plat...

Container Runtime: The engine that actually runs the container (e.g., Docker or containerd).

Containerd is an open-source project originally created by Docker Inc. and is now a graduated project of the Cloud Native Computing Foundation (CNCF). It is a container runtime that's part of the Docker ecosystem, but it can also be used as a stand-alone. It's designed to handle the execution and lifecycle management of containers and provides a robust and reliable runtime that can be embedded into higher-level systems such as Docker, Kubernetes, and other container orchestration platforms.

Note: For production environments, ensure TLS certificates are correctly configured. Refer to containerd documentation for additional configuration details. Once configured, k0s will utilize these settings to pull private images from your registry as needed.

The open source projects Fastly uses and the foundations we partner with are vital to Fastly’s mission and success. Here's an unscientific list of projects and organizations supported by the Linux Foundation that we use and love include: The Linux Kernel, Kubernetes, containerd, eBPF, Falco, OpenAPI Initiative, ESLint, Express, Fastify, Lodash, Mocha, Node.js, Prometheus, Jenkins, OpenTelemetry, Envoy, etcd, Helm, osquery, Harbor, sigstore, cert-manager, Cilium, Fluentd, Keycloak, Open Policy Agent, Coalition for Content Provenance and Authority (C2PA), Flux, gRPC, Strimzi, Thanos, Linkerd, Let’s Encrypt, WebAssembly. And the list goes on!

Containerd is a runtime tool used for managing image transfers and storage as well as managing OCI containers. It can be integrated with Docker but can also be used without Docker integration. By using runc, it can function as a standalone component.

And it is only because of the focus on extensibility and interoperability that today, we can run WebAssembly workloads in Kubernetes so seamlessly. SpinKube is an open source stack of projects for running WebAssembly applications. A core piece of the stack is a containerd shim. I remember when containerd was donated to the CNCF in 2017. That took work and collaboration from several companies, most notably Docker, to make happen. SpinKube also depends on CRDs and operators. I recall seeing one the early demos of scaffolding an operator and a CRD in a SIG meeting from Phillip Wittrock, who went on to work on Kubebuilder in a Kubernetes SIG. Kubebuilder is a key piece of SpinKube’s Spin operator development. As I reflect on the last decade, I appreciate every contribution even more deeply.

Containerd and nerdctl

Kubernetes on the backend used to utilize docker for much of its container runtime solutions. One of the modular features of Kubernetes is the ability to utilize a Container Runtime Interface or CRI. The problem was that Docker didn't really meet the spec properly and they had to maintain a shim to translate properly. Instead users could utilize the popular containerd or cri-o runtimes. These follow the Open Container Initiative or OCI's guidelines on container formats.