logoalt Hacker News

Imustaskforhelpyesterday at 5:46 PM2 repliesview on HN

Containers (docker/podman) are still not as secure as virtualization (qemu,kvm,proxmox)

Plus these might be smaller and might run faster than containers too.


Replies

throwaway894345yesterday at 7:41 PM

Smaller than containers seems unlikely since a container doesn't have any kernel at all, while these microvms have to reproduce at least the amount of kernel they would otherwise need (e.g., a networking stack). I'm sure some will be inclined to compare an optimized microvm to an application binary slapped into an Ubuntu container image, but that's obviously apples/oranges.

Faster might be possible without the context switching between kernel and app? And maybe additional opportunities for the compiler to optimize the entire thing (e.g., LTO)?

show 1 reply
m00dyyesterday at 6:41 PM

yeah it's a fairy tale.