►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
Container Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google (Intermediate Skill Level)
Containers are the modern way of running your services at scale because of the portability and lightweightness. However, due to the fact that they depend on OS multi-tenancy as they share the same host OS (usually Linux which represents a large attack surface), containers are considered providing weaker isolation than virtual machines. We will start from discussing the security principles in running services in Google, and then summarize a list of best practices we have explored for preventing, auditing and mitigating security threats. Specifically, we will focus on the challenges we have faced at the host operating system level.
"About Dawn
Dawn Chen (dchen1107@github) is a Senior Staff Software Engineer from Google Kubernetes Team. She has been one of tech leads in both Kubernetes and GKE, mostly focus on Node area. Prior Kubernetes, she was the one of the tech leads for Google internal container infrastructure for about 6 years.
About Zhengyu
Zhengyu is one of the tech leads and managers in Google infrastructure team, mostly focus on kernel and security."
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
Join us for KubeCon + CloudNativeCon in San Diego November 18 - 21. Learn more at https://bit.ly/2XTN3ho. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
Okay,
good
afternoon,
everyone,
this
is
Don
Chan
and
I'm.
A
software
engineer
at
Google
for
11
years
and
I've
been
working
on
the
kubernetes
project
for
four
years
before
kubernetes
and
working
on
the
book,
the
Google
internal
infrastructure,
the
internal
container
orchestration
for
seven
years,
and
many
of
the
you
knows.
Maybe
you
already
know
the
kubernetes
it
is
based
on
and
they
derived
from
the
Cooper
net
from
the
burger.
A
So
so
I'm
honored
and
also
very
pleased
to
say
the
owner
and
the
pleased
to
see
the
container
technology
emerged,
emerging
and
also
we're
happy
to
see.
Kubernetes
grow.
So
much
since
then.
So
today,
together
with
Jamie
my
coworker
and
we
are
going
to
talk
about
the
container
as
donation,
technology
at
Google
and
and
I'm,
going
to
start
on
the
content
as
donation
technology
and
how
we
Google
apply
those
cam
technology
and
chronologically
and
and
also
Jane,
is
going
to
talk
about
a
center
box
pack,
knowledge
and
also
at
the
end
he
will
introduce
them.
A
The
exciting
project
divider
the
Google
newly
open
sourced
the
project
sandbox
the
solution,
so
so
in
2013
darker
release
its
container
engine
and
at
latest
year
there's
the
meanings
of
the
tunnels
and
about
a
torrent.
Darker
image
been
pushed
to
the
registry.
Now
the
technology
is
the
real
name.
It
has
been
really
powerful
and
a
recent
containers
that
create
a
survey
conducted
by
the
enterprise
strategy
group
shows
about
a
40%
of
the
company
are
used
in
containers
in
some
way
and
the
docker
also
reports
there's
the
over
twenty
nine
million
dollar
banknotes.
A
So
in
Google
we
have
development
container
technology
and
using
container
to
manage
our
applications
for
more
than
a
decade.
So
every
week
we
launched
over
for
me
for
pinion
containers.
Why
people?
Why
do
people
like
the
container
technology
so
much
I?
Think
it
is
because
of
the
its
performance
as
donation,
repeatability,
quality
of
the
services,
accounting
and
visibility.
A
And
they
are
so
amazing.
Are
there
still
any
other
any
concerns
and
the
issues?
Actually
we
all
think
about
the
security.
A
consensus
still
remain.
The
same
survey
conducted
by
the
enterprise
strategy
group
shows
94%
of
the
company
failed,
I'd
container
latitude,
a
PI,
effective
security.
So,
during
the
last
decades,
Nina's
Community
Development
a
lot
of
the
work
on
the
isolation
mechanisms.
There
include
namespace,
C
group
capabilities
to
SATCOM
and
also
several
standard
solution
based
on
the
Linux
security
modules.
A
Now
I'm
going
to
briefly
introduce
to
talk
about
how
Google
apply
those
content,
isolation
in
our
production
collectively
so
Berger
was
born,
IT
2004
before
that
and
there's
the
other
auto
switching
system.
In
Google
majority
of
the
most
of
the
Google
production
work,
node
was
a
or
allocated
to
the
dedicated
machines,
some
of
them
even
run
as
the
router.
So
what
that
means?
It
means
those
userspace
process
have
a
full
access.
A
So
what
if
anything,
goes
wrong
in
this
model,
for
example,
a
bug
in
a
script
in
a
script
which
run
the
RM
comment
at
least
here,
and
because
that
variable
is
undefined,
so
you
potentially
kill
everything
remove
areas
in
other
systems.
Oh
there's
the
iguana
pin
in
here
or
Manisha
software
could
be
access
of
the
/bin
and
change
the
program
and
then
/p
and
all
mess
up
the
files
and
the
/e
TC
or
maybe
make
the
note
it
is
important.
A
So
this
is
obviously
in
spite,
so
nothing
should
of
your
system,
and
so
we
change
the
art
restriction
and
enforce
by
default,
all
those
work
note
and
majority
of
the
organized
and
privileged
user,
except
their
minimal
set
of
the
demons
and
the
node
they
want
to
perform
some
other
business
sheet.
Here
the
tasks
with
this
change,
all
those
those
the
user
space.
The
process
have
limited
access
to
those
devices
and
included
of
network
device,
and
they
have
a
limited
access
of
the
host
affair
system
and
also
the
performance
of
the
randos
kernel.
A
Costs
are
going
to
be,
will
be
checked
before
executed
and
also
the
process
cannot
ascend
a
secure
to
kill
the
random
process
owned
by
different
users.
Okay.
So,
but
if
those
process
still
high
potential
could
have
the
potential
night
dangerous
of
the
capability.
For
example
list
you
maybe
could
cite
your
ID
under
files
if
they
have
the
perhaps
that
UID
capability
right.
A
So
this
you
could
open
a
row
a
socket
and
if
they
have
the
cap,
nitro
pepper
bennett
here
what
that
could
happen
so
in
burger
by
default,
with
drop,
we
forced
most
of
the
capillary
or
dropped
by
default,
except
but
the
user.
The
the
could
request
the
job
could
request
the
particular
of
the
propene
E&T
and
to
perform
particular
of
the
tasks.
So
so
we
pretty
much
drop
all
those
of
the
administrative
of
the
community
for
majority
of
the
jobs.
So
we've
been.
A
We
really
truly
believe
what
feel
capability
has
the
battery
so
nation
and
national
today
I
took
work,
I
did
sorry,
I
did
the
darker
and
the
kubernetes.
Also
majority
of
the
company
has
been
dropped.
Accept
rose
those
capability
well
in
a
defined
predefined
into
at
least
so
with
that
change
in
the
book,
we're
okay
with
the
privilege
as
donation,
but
what
about
the
resource
as
donation
think
about
abusive
user
and
they
using
they
try
to
use
up
all
the
available
memory
in
the
system?
A
What
could
happen
it
could
and
cause
so
the
kernel
and
too
busy
with
after
reclaim
try
to
free
of
them
pages
and
before
it
is
kill
some
process
under
to
children
to
recover
of
the
node
and
the.
During
that
process,
everything
on
the
node
is
going
to
go,
slow
and
the
even
eventually
some
of
those
work
will
be
killed,
a
back
kernel.
A
So
how
is
resolve
that
problem?
We
apply
see
groups
and
to
limit
accountable
and
I
donated
the
resources
usage
of
the
containers.
So
we
use
in
those
kind
of
things
in
the
book
things
the
2007
and
when
the
first
say
group
or
to
being
the
first,
the
sequel
pool
concept
is
being
being
pushed
to
the
linux
upstream
kernel
kernel.
So
using
the
secret.
We
we
control
the
what
container,
I
use
but
still
container
can
see
all
the
processes
network
interface
mounted
points
on
the
system.
A
What
can
we
do,
and
so
we
apply
the
naming
spaces
and
we
use
demonstrates
to
control
what
container
has
seen
so
name
in
space
provide
the
fundamental
of
explanation
to
into
the
container.
So
there's
the
the
for
the
there's
the
sweet,
so
they
provide
the
donation
for
different
of
the
namespace
type
and
the
currently
in
the
Linux
kernel.
A
There's
the
seven
different
animal
species
being
supported,
Network
a
PID,
mount
user,
IPC
UTS,
see
group
and
in
there
more
to
coming
so
so
now
we
are
using
namespace
to
control
what
a
container
can
see
and
using
the
C
group
to
control
water
container
can
use
and
the
run
those
container
as
the
unprivileged
appreciated
to
country
what
it
did
him
perform
and
what
care?
What
did
it
occur
execute
is
that
enough.
A
So
Dan
washer
from
the
red
Hyder
said
I'd
2014
containers
do
not
contain
so
Linux
Linux
development
community
deployed
implement
a
civil
alternative
ways
to
configure
fiying.
How
short
the
accept
fact:
fine
grant
access
control
and
using
mandatory
access
control
and
the
top
two
most
popular
one
other
as
in
Linux
and
Obama,
and
also
Linux
community,
where
the
delivers
calm
to
which
to
restrict
what
occur
being
a
douche
associate
of
the
container
to
restricted
what
character
system
call
can
perform.
A
So
even
with
those
sustainable
solution
deliver
the
late,
Linux
native
Center
box
to
the
solution
delivered
and
still
we
may
have
the
still
have
like
the
wall,
impunity
and
explored
in
the
Linux.
So,
for
example,
most
recent
example.
It
is
because
the
container
shared
are
seeing
Linux,
networker
stack
and
there's
the
wanna
be
naked,
so
a
single,
more
form
to
packet
from
remote
that
can
crash
the
kernel
and
there's
the
more
like
a,
for
example.
The
dirty
call
caused
by
the
risk
condition
and
in
a
system
and
also
their
spectrum
and
the
mail
down.
A
A
We
have
that
kernel
issue
and
because
means
charge
of
the
kernel,
memory,
usage
and
the
cause.
Another
problem
is
donation
problem
unleash
a
special
resource,
isolation
problem,
so
now
I'm
going
to
hand
over
to
Jenny.
We
talked
about
all
the
sandbox
a
solution
and
include
of
the
G
better,
all
right.
B
It's
really
glad
like
we
have
as
a
container
fan.
Of
course,
we
we
being
trying
so
hard
actually
to
improve
containers
and
trying
to
actually
fix
I
think
is
the
most
important
problems
for
containers.
So,
let's
come
back
a
little
bit
as
a
developer
as
a
container
fan.
What
I
really
want
to
do
right,
I
just
wish
the
image
I
pulled
from
a
random
corner
word
like
I.
Just
want
some
run
something
right.
I,
don't
want
to
explore
my
nina
quacks,
because
that's
on
my
own
machine
and
I
don't
want
to
a
lot
of
work.
B
For
example,
I
want
to
like
write
a
fool,
oh
profile,
or
actually
figure
out
what
exactly
the
Cisco's
system
cause.
Actually,
this
app
is
making,
of
course,
I.
Don't
also
wonder
like
motivated
application,
but
otherwise,
what's
the
point
of
a
talker
right,
so
I
also
the
other
side
of
the
the
wish
is
basically
I
want
still
feels
like
a
container
I
want
to
stop
like
immediately.
I
also
want
a
chippy
to
rock
everyone
run.
A
lot
of
them
am
I,
really
cheap,
laptop
oops.
B
So,
on
the
other
side,
as
a
secure
engineer,
I
know,
I
need
a
more
than
one
secure,
eight
years
right
between
untrusted
workload
and
might
be
the
con
wallet.
The
principle
is
really
simple:
there
is
no
single
compromise
can
steal
all
of
my
coins.
Surprisingly,
this
is
the
same
principle
we
use
in
Google
all
right.
We
just
replace
like
Bitcoin
wallet
as
a
product
and
job
and
the
coins
is
just
a
user
data.
This
is
exactly
the
principles
when
we
actually
design
the
sandbox
and
actually
to
provide
some
security
protection
for
all
the
production
workload.
B
Let's
rethink
a
little
bit
about
the
continuation.
What
is
container
that
really
mean
right?
What's
the
interface
for
containers,
a
lot
of
people?
Actually,
some
customers
I
have
been
talking
to
don't
really
know.
What's
inside
container
they've
been
assuming
container
just
like
it's
a
humanik
thing
like
including
every
binary
in
raw,
but
ironically,
it
doesn't
really
include
the
kernel,
which
is
the
most
important
part.
The
interface
to
containers
is
the
system
core.
Let's
just
keep
that
in
mind
that
we
can
come
back
later.
B
There
are
some
needing
some
fun
facts,
as
Tom
mentioned,
Linux
is
really
really
I
mean
huge
system.
I
would
say
so
look
at
the
lines
of
code
in
each
kernel.
How
many
lines
they
I
think
Nina's
developers
are
great
I.
Think
of
the
thousand
developers
around
the
world.
Actually
writing
the
code,
which
is
great.
B
If
you
look
at
this
like
over
2,000
SCV's
since
1999
and
200
over
200
and
actually
can
result,
previous
education
actually
I've
personally
download
those
like
pretty
decorations
and
analyzed
and
I
found
like
80
ish,
exploit
actually
align
available.
So
I
can
come
back
to
that,
because
there
is
some
interesting
observations.
B
Okay,
then,
there's
some
a
little
bit
of
the
background
concept.
I
want
to
give
you
guys,
you
might
see
this
picture
in
keynote
today.
The
key
message
I
want
to
deliver
here
is,
like
sandbox,
actually
has
its
overloaded
Turner
alright,
so
it
has
so
many
millions
in
computer
science
in
like
the
software.
The
amendment
is
basically
in
your
environment.
B
Is
that
the
bill
like
the
deployment
or
develop
your
application,
but
the
sandbox
I'm
really
talking
about
today,
is
just
ask
you
delay
to
reduce
the
attack
surface
to
a
host,
and
somebody
also
think
like
sandbox,
is
actually
can
protect
the
application
itself
from
a
compromised.
The
host,
for
example,
some
like
some
work,
like
mini
parks
like
s
Kong,
those
works,
use
a
six,
but
that's
out
of
the
scope
of
this
talk
will
only
talk
about
how
we
actually
actively
reduce
the
attack
surface
of
the
host
okay.
B
Let's
recap,
since
down
also
talk
about
our
mo
SE
nuke.
Second
PPF
I
categorize
it
as
a
rule
based
and
box
what
it
does
is
actually
say:
I
restrict
what
the
application
can
can
do
right.
A
per
mo
is
based
on
the
file
path,
so,
as
I
seen
in
express
an
inode
sakam
is
like
just
fill
out
the
cisco's,
but
the
the
same
principle.
B
B
There
are
some
people
how
many
of
you
actually
have
written
any
profiles.
Oh,
that's
great.
Three,
five,
six,
okay,
great
you
guys
are
pros
so
I'm
totally.
This
is
really
I
mean
you
need
the
pros
to
actually
write
the
profile
so
downwash.
Actually
we
cite
the
his
quote
and
because
I
like
this
guy
and
it's
great,
he
also
created
a
website
to
I
say
stop
disabling
a
senior's.
Why?
Because
people
just
sent
when
you
actually
have
problems
with
a
Scenic's?
The
first
thing
you
do
is
publish
as
a
sent
in
force
equal
to
zero.
B
That's
what
people
do
right
and
the
other
side
of
the
the
other
type
of
sandbox
is
called
Cisco
filtering,
I.
Think
since
1999
or
since
96,
or
maybe
really
like
since
Petrus
is
rented
people.
Petrus
is
really
a
debug
interface
for
the
kernel.
However,
smart
people
have
been
inventing
sandbox
around
them,
because
once
you
can
intercept
the
sandbar
Cisco's,
actually
you
can
do
certain
filtering
or
maybe
redirecting
those
Cisco's.
The
problem
over
Cisco
pay,
sorry
P
trade
spaces
sandbox
is
the
checking
is
in
the
user
space.
B
They
were
naturally
just
like
a
vulnerable
to
Tambo,
check
and
time
to
use
warren
beatty's.
If
it's
multi-threaded,
because
you
can
easily
trigger
risk
condition
and
then
people
have
been
doing
like
rotary
and
a
bunch
of
like
keys
cook
and
they
have
been
holo
working
and
working
on
the
solution
for
Chrome
OS
and
the
Chrome
browser,
which
is
called
like
some
comp
recently
upgraded
to
be
PF
and
even
IPPF.
B
The
best
part
of
this
approach
is
is
in
kernel,
so
naturally
you
you
can
copy
the
data
to
the
checking
and
then
use
it
right,
dereference,
the
pointer
or
whatever.
So
what
not?
A
server
to
the
talk
to
attack
and
the
other
recent
invention
also
I,
think
Frank
home
is
they
have
the
auto
Cisco,
but
it's
slightly
inflexible
because
they
don't
have
the
PPF
instructions.
B
If
you
guys
are
familiar
with
the
PPF,
the
right
Snyder
has
a
centimeter
of
the
PPF.
It's
also
I
mean
you
need
some
knowledge
to
actually
write
this
thing
so
still
not
easy
right.
So
writing
a
Lewis
is
really
tedious.
I
trying
to
cheese
like
Jesse
here,
it's
like
smart
engineers,
like
Jesse,
will
automate
that
right.
She
has
made
great
tools
actually
to
automatically
generate
that
and
the
based
on
the
static
analysis
of
the
binary.
B
However,
the
rules
can
be
also
fragile
can
be
overfitting,
which
means
your
application
actually
may
break
or
undo
feeding,
which
means
you
actually
allow,
maybe
two
more
than
200
of
Cisco's
I
just
have
a
friend
in
remember,
because,
as
a
go
user,
you
have
to
improve,
like
include
Ipoh
p
weight,
because
it's
a
recent
addition
to
the
quarantine
itself.
Ironically,
that's
because
Android
actually
only
allows
the
Cisco
for
go
to
run
Android.
You
have
to
use
this
Cisco
instead
of
the
Ipoh
weight
anyway.
So
it's
a
problem
caused
by
second
about
by
Cisco
of
filtering.
B
Then
a
lot
of
people
like
us.
We
have
to
fix
our
second
PPF
filters.
At
the
same
time,
it's
not
a
complete
safe,
because
you
still
subject
to
spekt
spective
meltdown
those
kind
of
hardware
bugs
okay,
then
this
come
to
a
new
set
of
solutions.
Right
I
want
to
give
a
big
shout
out
to
cut
a
continuous
and
also
connect
on
is
a
hyper
and
even
no
VM,
also
coming
from
Google
they're
being
actually
working
on
solution,
which
is
great.
It's
like
universal
right,
so
it's
hypervisor,
based
hypervisor,
basically
base
give
us
the
strong
isolation.
B
B
For
example,
when
you
actually
launch
your
container,
you
have
to
tell
this
VM
how
many
CPUs,
how
many
Mary
you
can
give
to
this
VM
instead
of
like
running,
you
see
group
like
a
native
container,
and
then
you
actually
increase
the
CP
coda
or
increase
the
memory
at
one
time,
and
then
let's
go
back
to
the
picture
again
right,
so
I
think
VM
base
or
hypervisor
base
security
is
great.
We
really
want
that.
B
B
How
do
we
are
going
to
guarantee
that
when
you
actually
switch
that
all
the
azores
gonna
switch,
for
example?
However,
there
are
some
crateros,
for
example,
this
virtualized
hardware
interface,
how
to
virtualize
how
to
invest
is
not
really
I
mean,
can
be
directly
consumed
by
containers.
It
speaks
like
IO
port,
interrupt
exceptions.
B
B
Okay,
then,
when
we
apply
the
news
condo,
the
problems
comes
like
nukes
is
really
a
one-size-fits-all
solution
and
which
design
is
really
actually
designed
to
actually
to
run
a
fixed
number
of
resources,
because
you
cannot
easily
unplug
the
CPU
memory
from
physical
machines
and
it's
also
moolah
lithic,
so
everything
in
the
same
address
space,
although
recently
they
have
been
using
KPD
I,
cannot
page
table
isolation.
Vegetable
revelation
due
to
the
meltdown,
so
this
is
our
proach
I'm
really
excited
to
introduce
this.
We
figure
out.
B
Okay,
how
about
we
just
keep
those
good
in
the
gradients
from
the
VM
solution,
but
without
the
Nina's
kernel.
So
that's
why,
when
we
went
had
actually
spent
five
years
developing
this
project,
it's
basically
what
is
G
visor
here
is
basically
a
user
space
kernel
written
from
scratch
in
go
so
and
also
we
have
some
certain
hypervisor
hypervisor
solutions
as
well
as
the
PJs.
If
you
are
familiar
with,
that
is
basically
a
Linux
native
way
to
actually
insert
the
Cisco's.
B
B
So
what
is
it
really?
It's
actually
for
you
to
sandbox
untrusted
applications.
As
I
said,
it's
a
it's
an
open
system
approach.
We
implement
the
new
season,
API
seen
user
space
over
the
200
Cisco
so
far,
but
not
all
the
flags
or
basically
add
those
flags
on
demand.
I,
wouldn't
customer
me
that
it's
pretty
actually
nice.
Actually,
when
you
write
Cisco's
impotency
Zingo,
it's
just
like
you
are
driving
Jose
Ferrari
versus
like
I'm,
sorry
I'm,
just
like
colaborate,
but
okay.
So
it's
not
a
report
like
UML,
because
I
got
yesterday,
we
were
open
source.
B
We
got
a
naturally
got
a
lot
of
questions
and
hockey
news
and
even
get
Harbor
and
read
it.
You
say
hey.
This
is
basically
a
approach.
It's
a
UML
style
interception
for
a
PTAs
platform
and
pfr
phone.
The
problem
people
seen
Petrus
is
kind
of
slow
and
I
was
saying,
not
race,
free.
It's
because
it
has
a
synchronous
nature
when
you
actually
in
SAP
Cisco's
right.
We
do
CCM
you
as
you
wait
to
that
Cisco.
Wait
for
that
process
and
you
have
to
process
there
and
the
G
visor.
B
Yes,
we
use
our
model,
it's
just
to.
Let
you
guys
to
run
G
visor
everywhere
right
because
Peterson
right
now,
it's
kind
of
universal,
not
just
filters
as
just
supposed
to
second
PPF,
because
we
implement
those
six
goes
in
the
user
space.
Really
we
implement
200
over
206
goes
almost
I
mean
2/3
of
the
existing
Linux
surface
and
most
popular
ones
covers
I,
mean
a
huge
surface
like
people
gonna
use
by
using
64
Cisco's
to
the
host.
So
we
also
can
run
unmodified
the
panels
binaries.
B
B
We
don't
have
to
filter
only
anything,
because
you
have
over
200
Cisco's
to
use,
and
we,
like
I,
said
it's
a
union
panic
on
one
can
open
sandbox
so
also
to
know
that
we
also
building
a
savory
store
feature,
which
is
a
potential
actually
for
you
to
implement,
for
us
also
to
implement,
like
a
knife
library
creation
to
actually
let
the
people
to
use
G
visor.
You
cannot
easily
just
use
a
corner
right,
so
we
created
a
runtime,
it's
the
OCI
paste
or
runtime.
It's
powered
by
G
visor
basically
runs
the
usages.
B
Sometimes
we
need
to
request
like
host
resources
will
go
to
the
host
Colonel
and
she,
for
example,
just
like
get
us
some
memory
right
just
do
a
map
and
of
course
we
want
to
be
me
that
interface
I
said
we
limited
to
like
60
full
Cisco's
also
apply
namespaces
and
other
rule-based
sandbox
technologies.
You
can
think
of
gia
is
basically
a
layer.
The
solution,
that's
how
we
actually
provide
isolations
and
also
I
forgot
to
talk
about
the
Gopher
and
during
remember
when
I
said,
like
I,
did
the
analysis
for
the
20
ish
exploit
for
Linux?
C
B
The
first
one
is
socket.
The
second
one
is
open
right.
They
actually
they
took
like
they
actually
are
being
I.
Think
almost
40%
of
the
of
all
Cisco's
are
being
used
as
the
attack
vectors.
What's
the
company
in
this
with
Cisco's,
this
comes
in?
What's
incoming
Cisco's
is
actually
those
Cisco's
are
for
users
to
get
additional
host
resources.
So
what
we
learn
here
is
actually
we
apply
to
the
century.
B
With
this
Lau
socket
with
this
allow
open,
you
can
add
on
any
open
any
file
once
you
load
the
untrust,
the
application,
but
then
how
you
actually
open
the
files.
So
that's
why
we
have
the
Gophers.
So
that's
why
we
use
the
9p
protocol.
Actually,
it's
practice
rule
or
the
file
system
or
the
file
system
operations.
So
even
sentry
is
compromised.
You
still
cannot
get
any
guaranteed,
cannot
get
any
additional
resources
through
open,
socket
and
even
like
stock
appear
like
any
like
normal
UNIX
means
and
his
numbers,
it's
really
made
for
continuous
right.
B
So
we
have
150
it's
kind
of
conservative,
because
I
don't
want
to
surprise
you
guys
115
Mike,
a
millisecond
startup
time.
I
will
use
a
pinch.
You
here
basically
startup
in
Chu
and
the
memory
overhead,
because
he's
written
from
scratch,
it's
go.
We
avoid
a
lot
of
like
it.
We
basically
write
a
lot
of
like
a
library
power
self
and
is
really
15
megabytes
overhead.
If
I
just
run
up
in
sleep,
if
you
don't
believe
it,
it
try
it
and
also
you
can
use
it,
go
right.
No,
fixed
resources!
I!
B
Don't
need
to
tell
you
how
many
CPUs
we're
going
to
use
right
in
case
you
might
actually
want
to
increase
that
a
footprint
we
want
to
scale
it
up
an
easy
to
debug,
you
imagine,
you
actually
have
open
system
can
put
up
in
sub-second,
and
even
you
have
a
bug
there.
It's
pretty
easy
actually
to
debug,
instead
of
actually
waiting
for
a
crashing
machine
right.
So,
however,
there
are
still
some
cautions.
I
want
to
remind
you,
because
sandbox
means
the
security
actually
not
never
comes
free,
free
right.
B
So
jiva's
is
really
good
for
small
containers
for
civilus,
for
small
jobs,
for
no
J's
those
kind
of
thing,
because
it
spins
off
really
quickly
and
it
can
skills
up
and
also
for
high-density.
You
can
pack
a
lot
of
jobs
and
the
same
physical
machines.
What
is
not
good
for
trusting
images
right,
so
you
don't
need
these
additional
layers
and
also
Cisco
heavy
workload.
I,
don't
know
who
actually
writes
applications
just
to
in
Cisco's
also
the
record
access
to
hardware.
B
B
This
is
the
my
favorite
treat
like
from
yesterday
after
open
source.
Yes,
I
want
to
answer
to
Bremen.
Actually,
I,
don't
know
if
he's
here.
This
is
actually
one
of
the
major
motivation.
I
would
say,
Rudy
major
motivation
for
to
enjoy
wiser,
because
we
actually
want
to
accelerate,
always
research.
If
you
actually
have
any
cool
ideas,
new
ideas,
if
we
can
actually
implement
user
space
in
go,
then
actually
you
can
actually
iterate
match
faster
than
you
actually
develop
in
Linux.
Yes,
that's
actually
one
of
the
major
goals.
I
say
this
is
a
perfect
use
case.
B
Fuji
rather
want
to
try.
Please
go
to
our
github
page
surprisingly,
which
is
open
source
like
we
open
the
repo
yesterday
noon
and
we
regard
like
over
two
thousand
stars
we're
just
really
encouraging.
We
have
six
comments
around
and
you
are
ready
to
go.
Please
try
it
out.
If
you
see
any
bugs
file
a
bug
to
us
one
more,
we
can
talk
to
us
to
add
the
G
by
the
booth.
I,
don't
know
if
we
still
have
one
I
don't
know.
Also,
please
join
the
mini
list.
B
Also,
you
can
get
any
involved
and
maybe
just
join
signal
discussion.
We're
gonna
help
we're
gonna
hold
tomorrow
and
there
are
all
more
talks
from
Google,
actually
talking
about
like
what's
beyond
sandbox
right,
so
I
think
it'll
be
a
lot
of
interesting
things
in
this
equipos
talk
like
by
team
and
also
the
runtime
security
talk
by
Maya
I
also
want
to
shout
out
team
I
think
this
is
just
showing
this
is
real
product.
Alright,
so
that's
it.
Thank
you.
B
B
Would
say
the
peaches
platform
definitely
or
have
certain
security
protection
for
you,
because
the
Cisco's
at
least
is
going
to
be
implementing
century
even
centuries
compromised.
You
are
still
protected
by
the
second.
So
what
can
go
wrong
right?
So
we
succumb
sorry
I
haven't
done
yet.
However,
if
you
compare
against
like
a
VM,
I
will
say
KVM.
Definitely
it
will
give
you
a
peace
of
mind.
I'll
put
it
this
way
because
the
virtualization
and
also
the
performance
right.
So
if
you
look
at
this,
although
is
doing
experimental
I
would
say
it
was
trying.
E
Because
we
are,
we
are
working
on
some
something
like
don't
you
stop
us,
but
also
buy
you,
some
EPP
I
food-related
fiddle
to
implement
those
part
of
the
system
called
catch
and
redirect
and
process.
So
if
we
use
that
to
substitute
the
petrous
part,
we
all
think
it's
it's
reached.
The
go
of
you
think
about
security.
B
C
B
I
probably
not
the
best
person
to
explain
the
KVM.
I
don't
know
if
anything's
here,
probably
not
okay
KVM,
we
uses
the
different
three
than
Q,
so
we
use
we
definitely
use
a
KVM
to
actually
create
to
put
the
CPU
into
the
VM
X
down
remote,
alright
to
actually
drop
the
previous
you
if
you
think
that
way.
However,
we
do
use
like,
for
example,
giving
like
a
crazy
view.
We
create
CPU
on
each
thread
creation.
You
can
say
each
chrome
is
mapped
to
a
creates,
receive
you
and
we
also
use
EPT.
B
We
have
like
internal
page
table
manipulation
actually
to
actually
map
with
those
like
physical
pages.
So,
however,
there's
or
put
this
way,
KVM
actually
for
us,
is
to
provide
the
lower-level
support
into
most
of
like
the
provision
separation
and,
though
level
like
I,
said
like
the
page
and
support
for
that.
That's
that's
the
only
thing
we
need
actually.
C
B
B
Linux,
the
UML,
the
UML
I've
heard
they've
trying
to
solve
this
SMP
actually
may
be
in
cyclic
I,
don't
know
if
I
can
talk
about
that
or
they
have
been
trying
to
use
like
different
stranding
models
for
us,
because
we
don't
use
an
inner
scheduler,
so
we
don't
suffer
from,
for
example,
spin
locks
and
synchronization
the
we
basically
map,
like
one
application
thread
to
one
go
routine
so
which
actually
just
led
us
to
use
the
role
of
current
and
schedule.
So
I,
don't
think
this
is
a
problem
for
us.