alt Hacker NewsWhat is even more worrying is that most do not even consider a VM necessary as sandbox solution.
The hierarchy goes something like this:
0. guardrails
1. containers (=namespaces + cgroups)
2. userspace kernel shims like gVisor
3. virtual machines
Most people still consider level 1 sufficient and they are in for a rude awakening.
Replies
Guardrails as security controls are such a joke. They remind me of the Pirates of the Caribbean scene about the Pirate Code… “They’re more like guidelines”
I code review vibe coded stuff for companies quite often and many people tell me confidently the AI runs safely inside a container & VM, while it really doesn't. They don't have any way to check as they don't know how things work, but the AI mentioned virtual machines and containers and that's what they remembered.
If I thought my AI was going to hack me why would I run it?
2 and 3 are virtually on top of each other. they both use KVM too.
technically 2 exposes a slightly broader attack surface due to the tighter integration model.
you can think of 2 as what would happen if you take 3 and modify it to share resources with the host better. except that they did it from scratch in the memory safe language Go.