google/gvisor on Hacker News

…), meaning that we're now running stock Go in the gVisor sandbox ( https://github.com/google/gvisor ). We've removed all of the restrictions present in the old runtime, like limited socket and file access. You can even import

comment by buss · 2018-10-16 · in App Engine’s New Go 1.11 Runtime

…), meaning that we're now running stock Go in the gVisor sandbox ( https://github.com/google/gvisor ). We've removed all of the restrictions present in the old runtime, like limited socket and file access. You can even import

comment by buss · 2018-10-16 · in Go 1.11 on App Engine

While not a full kernel, Google's gVisor is a userland Linux kernel emulator written in Go: https://github.com/google/gvisor They use it in production for App Engine sandboxing.

comment by lima · 2018-10-08 · in The benefits and costs of writing a POSIX kernel in a high-level language

…was my long-winded way of saying that our go_generics are not an obvious argument in favor. [1] https://github.com/google/gvisor/blob/f3060cb1a4ed61199688b5... [2] https://github.com/google/gvisor/blob/8fee8f4dd5f7257a7eb77c... [3]…

comment by prattmic · 2018-09-02 · in Notes on the Go2 Generics Draft

…their own generics implementations. https://medium.com/@arschles/go-experience-report-generics-i... https://github.com/google/gvisor/blob/master/tools/go_generi...

comment by zmanian · 2018-09-02 · in Notes on the Go2 Generics Draft

…om/@arschles/go-experience-report-generics-i... They've been using a code generator as a work around: https://github.com/google/gvisor/tree/master/tools/go_generi...

comment by jasonwatkinspdx · 2018-08-29 · in Go 2 Draft Designs

Hi. I'm the PM at Google Cloud on the Second Generation runtimes. This is based on gVisor ( https://github.com/google/gvisor ), but it does not use the ptrace sandboxing that is in the mainline open source project. Our First Generation…

comment by mattsoldo · 2018-08-21 · in Beta release of PHP 7.2 in the Google App Engine standard environment

…out new AppEngine runtimes waaay faster. [0] https://news.ycombinator.com/item?id=17717045 [1] https://github.com/google/gvisor

comment by kyrra · 2018-08-21 · in Beta release of PHP 7.2 in the Google App Engine standard environment

…this new stack in place, we should be able to deliver runtime updates significantly faster. [1] https://github.com/google/gvisor

comment by stewart27 · 2018-08-08 · in Python 3 is now available on App Engine standard environment

This is the link you are looking for: https://github.com/google/gvisor

comment by philips · 2018-07-11 · in Runq – Runc-based runtime to run regular Docker images in KVM/Qemu

…meant that some apps & code wouldn't execute correctly. We now use technology based on gVisor ( https://github.com/google/gvisor ) in production for App Engine standard. This allows us to release new language runtimes unmodified. Node.js…

comment by mattsoldo · 2018-06-12 · in Node.js is now available on App Engine standard environment

Or in Go: https://github.com/google/gvisor

comment by walterbell · 2018-05-31 · in Depressing and faintly terrifying days for the C standard [pdf]

…details to sign up with their public cloud, but I might grab a spare box and give it a try. [1]: https://github.com/google/gvisor

comment by lima · 2018-05-26 · in PatternFly – a web UI framework by RedHat

…through a sentry process which does some kind of emulation of virtual memory through some magic. [ https://github.com/google/gvisor/blob/797cda301677abc8523d5a... ]. like ultimately, i think mmap() system calls need to be executed in the…

comment by benmmurphy · 2018-05-21 · in Containers, Security, and Echo Chambers

…in production so I'm not sure what you mean by "how vitally important security is in that domain". https://github.com/google/gvisor

comment by Thaxll · 2018-05-10 · in Rust 1.26 released

…testing purposes primarily, and runs on stock kernels without special permissions. From: https://godoc.org/github.com/google/gvisor/pkg/sentry/platfo...

comment by dward · 2018-05-03 · in Open-sourcing gVisor, a sandboxed container runtime

I started by reading here https://github.com/google/gvisor/blob/master/pkg/sentry/plat... Basically the Sentry binary works as both the VMM and the guest kernel. It uses the KVM API to setup page an address space and installs fault…

comment by ithkuil · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

…But it is light on details, I was curious how and to what extent it proxies filesystem API. [1] https://github.com/google/gvisor/blob/0c7d73b31ae5e7ba506866...

comment by zzzcpan · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

…new file, by doing name replacement, prefixing/suffixing for variable, method, and class names. [0] https://github.com/google/gvisor/blob/master/tools/go_generi...

comment by kyrra · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

…UML. The gVisor kernel (Sentry) runs in an empty user namespace with seccomp filters applied. [1] https://github.com/google/gvisor

comment by antoncohen · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

…sandboxing and enable developers to easily sandbox their workloads. (Note: I work on gVisor.) [1] https://github.com/google/gvisor/blob/master/runsc/boot/filt... [2] https://github.com/google/gvisor#file-system-access [3] Note we don't…

comment by prattmic · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

…I find the description on Github much more interesting than the one on the Google Blog: https://github.com/google/gvisor

comment by loudmax · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

Money quote from https://github.com/google/gvisor for Linux folks who have been around for a while: "gVisor's approach is similar to User Mode Linux (UML), although UML virtualizes hardware internally and thus provides a fixed resource…

comment by fulafel · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime

…like a VMM, it will not allow the application to directly control the system calls it makes." [ https://github.com/google/gvisor ] TLDR; This is a user-space process that hooks syscalls/ioctls made by your "containerised" applications. (1)…

comment by xtrapolate · 2018-05-02 · in Open-sourcing gVisor, a sandboxed container runtime