Heterogeneity is bffs with security though. Maybe option z isn&#x27;t so bad after all.

Option L) Hacker realizes theres more to be gained from joining the builders and shows both sides how to secure their lots against people worse than them

Option A) Everyone shares one OS (container, sandbox, kernel, firewall, whatever). It gets a lot of eyes on it to find bugs. Hacker fuzzes it with a lot of tokens offline. He finds one exploitable vulnerability and he owns everyone.Option Z) Everyone vibe codes their own custom OS. Each implements and exposes only what they want. Hacker has to beat up on it online to find vulnerabilities. He finds one and he only owns that one machine.There&#x27;s probably some middle ground between A and Z, but monocultures are fragile. All eggs in one basket, potato famines, banana fungus, etc...

Not OP but security and ressource usage are often the main motivators.For security, GVisor is probably the most widely used userspace-kernel. A userspace kernel may also boot faster and use less resources as it can offload a lot of work to the host (FS drivers etc.)

The question I always have when I see these userspace kernels is, Linux in Userspace exists. You can boot Linux with a root in userspace already. Why write a new kernel from scratch instead of fixing&#x2F;improving usermode Linux instead, which has the benefit of providing the entire Linux API already?

It seems to be more like gVisor than UML, providing a restricted kernel interface as opposed to the full kernel.

How is Ginux different from User mode Linux?<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;User-mode_Linux" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;User-mode_Linux</a>

In that case, wouldn&#x27;t it make more sense to build the Linux kernel without those features, or to replace them with sufficient mocks?

&gt; The Linux kernel is a gigantic attack surface with a ton of legacy stuff most modern applications will never need. Namespaces do not really help with this, but userspace kernels can. (Haven&#x27;t looked into Ginux enough to know if it does.)This is incorrect. If you can&#x27;t trust Linux because it is gigantic, you can&#x27;t trust a whole another new kernel. Userspace is not blackmagic.

The Linux kernel is a gigantic attack surface with a ton of legacy stuff most modern applications will never need. Namespaces do not really help with this, but userspace kernels can. (Haven&#x27;t looked into Ginux enough to know if it does.)That is also why I believe the namespace approach, and by extension Docker-like containerization, is a dead end when it comes to isolation. I hope something like gVisor will win.This is even more important since agents have turned isolation from a datacenter topic into everyone&#x27;s concern.

It’s the same approach as gVisor. Fairly decent isolation if your application can work on it, but your SOL if a scenario comes up that doesn’t work. VMs give you pretty much 100% Linux compatibility at the expense of density, optimal resource allocation and startup time. gVisor gives you excellent startup time, resource allocation and density at the expense of some app compat and performance at the extremesEdit: at least with gvisor you get close to a decade of work on compat. gVisor can support some rootless containers scenarios and systemd these days.

I’d be very interested in it if it started to approach VM style isolation without needing KVM access (or qemu).But I’m not sure if that is really possible.The use case I’m thinking about is a sandbox exec isolation on an HPC cluster without Docker. I know singularity&#x2F;apptainer exist, but I’m always looking for something that could make that environment more flexible. It is a tight security environment, so we are always limited in what we can do.

I wonder if this can grow into a capability-based security tool.

I’m still fascinated by the approach, though. It seems to me that it sits somewhere between cgroups and virtual machines.I do wonder what problem it solves, as I don’t think that it provides the same security guarantees that micro-VMs like firecracker do?

Rootless namespaces are getting better, but they don&#x27;t eliminate the host kernel attack surface

You can combine hypervisors, user space kernels and linux namespaces all into one solution. The attacker will have to escape all of them.

Isn&#x27;t this also adding a capability sort of like OpenBSD&#x27;s pledge?

If it has to go through another layer , hopefully without ring0 privs, which more than likely may filter out a number of exploit vectors, how is this the wrong approach ?Breaking this layer doesn;t automatically give ring0 privs across the hardware.

The project says:&gt; That research phase is complete.So not sure what part of it now constitutes &quot;research and exploration&quot;.

&gt; Telling someone&#x27;s research and exploration is wrong...Never change, HN, never change :D

This is kind of the wrong approach when linux namespaces exist and rootless namespaces are approach full spectrum.

From the README&gt; The current implementation includes a security-focused x86-64 interpreter and a balanced native ptrace backend;ptrace allows you to have the kernel redirect syscalls back to userspace, mostly for debugging purposes. &quot;balanced&quot; here refers to speed, but the overhead is still quite high.

So how exactly can you control multiple isolated address spaces for the leaf user processes and how do you handle syscalls? Does the host kernel have facilities for normal user processes to do so?

Talk about pivoting. I guess that&#x27;s what you call lean and agile.

Post from yesterday:
<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=50424147">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=50424147</a>

probably you get more isolation with jslinux

My immediate thought was this: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;User-mode_Linux" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;User-mode_Linux</a>More seriously, it is a great use of indirection insofar as replacing the full Linux kernel is a gargantuan task. A userspace kernel per task or task group.. makes a lot of sense. I&#x27;d be interested to know how it captures syscalls - eBPF? It wasn&#x27;t obvious from a skim of the readme.This kind of give-me-this-interface work seems pretty perfect for LLMs, too.

To me, it&#x27;s that little effort was put into it, so no commitment has been demonstrated. You wouldn&#x27;t want to build anything serious on top of it because you&#x27;d probably just have to throw it away.A project picked up casually, for a short time, is likely to be dropped casually, in a short time.

A userspace kernel is already pretty niche. Not many people will get anything serious out of it.The slop problem is also a challenge to overcome. The project barely existed and has already pivoted in a completely new direction. Who knows when this direction bores the author and we get yet another pivot. Or the author loses interest and we end up with a dead pile of abandoned code like so many other LLM generated projects.The previous state of the project could&#x27;ve made for an interesting VM runtime (safety of Rust without the issues that come with the lack of ported drivers). For this new direction, I don&#x27;t think there&#x27;s a similar sort of demand.Stating that nobody will take it seriously is probably an exaggeration, but I consider these projects to be toys for the author to play with, I don&#x27;t see why you would take more interest than going &quot;huh, neat I guess&quot;.

Why should someone spend anytime on this kind of technical piece that is not created by human? Think about what you will get from this, the answer is pretty obvious.

Why? Because a user space kernel is a bad idea? Or because of the AI use when writing it?I’m still trying to figure out exactly what it is.

The issue with this kind of thing is nobody will take it seriously.

When something has to be secure and battle-tested, this won’t happen. It can be written with the help AI, but it needs many humans to verify.

Can you link to an AI contribution to the mainline kernel that qualifies as slop?

Don&#x27;t worry, Linus-Linux already stands on the AI slop side.

Guys - AI slop is winning the war. Soon the Top 500 Supercomputers
will run AI-Ginux rather than Linus-Linux.

Greg Kurtzer's Ginux is now a userspace kernel