logoalt Hacker News

topspinlast Tuesday at 9:27 PM3 repliesview on HN

In your high level "You might not want to use it if" points, you mention Docker but not why, and that's odd. I happen to know why: io_uring syscalls are blocked by default in Docker, because io_uring is a large surface area for attacks, and this has proven to be a real problem in practice. Others won't know this, however. They also won't know that io_uring is similarly blocked in widely used cloud sandboxes, Android, and elsewhere. Seems like a fine place to point this stuff out: anyone considering io_uring would want to know about these issues.


Replies

melhindilast Tuesday at 9:35 PM

Very good point! You’re absolutely right: The fact that io_uring is blocked by default in Docker and other sandboxes due to security concerns is important context, and we should have mentioned it explicitly there. We'll update the post, and happy to incorporate any other caveats you think are worth calling out.

abc123def456yesterday at 12:05 PM

Do you know if this still applies if you run a docker container with host networking enabled?

haydlast Tuesday at 11:26 PM

Is this something likely to ever change?