HNGlance

Top Best New Show

Quark – A secure container runtime with CRI/OCI interface

https://github.com/QuarkContainer/Quark

by andutu • 2 years ago

24 2 2 years ago

GI

Related Stories

Loading related stories...

Comments

2

BobbyTables2• 2 years ago

Is there any real point to this?

Is this effectively anything more than a syscall filtered container?

To me, relaying syscalls from a guest in a VM to a host sounds like it is defeating the whole point of the VM!

At least normally a VM doesn’t have direct access to host syscalls — it is confirmed to the emulated block and network devices which (should) provide a constrained means of access.

Container escapes often happen because of exposure to host kernel interfaces (via syscalls!), and kernel file systems such as /sys and /proc (especially /proc/self shenanigans).

I fear they have reinvented a container, much less efficiently.

kjok• 2 years ago

Very cool! Curious to know the use cases for this tech?

Source preview

github.com

HNGlance

© 2024-2026 HN Glance. Story content belongs to its original sources.

Privacy
Terms