The Linux kernel is a gigantic attack surface with a ton of legacy stuff most modern applications will never need. Namespaces do not really help with this, but userspace kernels can. (Haven't looked into Ginux enough to know if it does.)

That is also why I believe the namespace approach, and by extension Docker-like containerization, is a dead end when it comes to isolation. I hope something like gVisor will win.

This is even more important since agents have turned isolation from a datacenter topic into everyone's concern.

I’m still fascinated by the approach, though. It seems to me that it sits somewhere between cgroups and virtual machines.

I do wonder what problem it solves, as I don’t think that it provides the same security guarantees that micro-VMs like firecracker do?

Rootless namespaces are getting better, but they don't eliminate the host kernel attack surface

You can combine hypervisors, user space kernels and linux namespaces all into one solution. The attacker will have to escape all of them.

Isn't this also adding a capability sort of like OpenBSD's pledge?

If it has to go through another layer , hopefully without ring0 privs, which more than likely may filter out a number of exploit vectors, how is this the wrong approach ?

Breaking this layer doesn;t automatically give ring0 privs across the hardware.

> Telling someone's research and exploration is wrong...

Never change, HN, never change :D