gVisor and Firecracker are nothing alike. gVisor is an application kernel written in Go. Application kernels will make your system much slower and can only solve a subset of security issues that would affect the kernel. They're like a kernel proxy of sorts.
Firecracker is a KVM virtual machine but made much more efficient. It's the most desirable of the two. Firecracker and KVM don't require bare metal, but in a virtualized environment they will require nested virtualization support. Nested virtualization is supported by just about every hyperscaler.
The reason KVM is preferable is because it provides strong isolation of the host kernel interface and independent emulation of host devices.
[–] tptacek 1 day ago
[–] eddythompson80 1 day ago
I haven't used gVisor in a while, but could you mount an NFS or CIFS share on gvisor or can you manage nftables, seccomp, namespaces, etc? At least that didn't use to be possible. So depending on the solution you're trying to provide, there was a big difference.
[–] tptacek 1 day ago
[–] oooyay 1 day ago
The security professionals whose sentiments you were describing would surely care. I was answering as a software engineer that often works at this level of security. I would and do care.
[–] eddythompson80 1 day ago
Google tried to do their Cloud Run gvisor only, then 2 years later switched to a hypervisor (though I don’t know if they use kvm or something else). That has been my experience also in trying to run an “emulated” Linux anything. Eventually some tough compat issue arrises and you wish you had just ran the real thing and figured all the issues with that instead. Tbf, gVisor offers much better density and much easier resource management etc. just the compat issues are tough unless you’re willing to (or can) say no to some scenarios.
Firecracker doesn't require bare metal, but (1) you want it for performance and efficiency at scale and (2) you take a security hit for nesting.