"Outer" container & Qemu process isolation

[jcvenegas]

From @dlespiau on September 9, 2016 11:21

Most of the OCI isolation/security features don't directly apply to the qemu process, but to the workload process inside the VM (eg. seccomp filters).

However we want to:

• apply some of those isolation features to the qemu process (eg. CPU limits). The exact list is TDB.
• unconditionally harden the qemu process. libvirt has a page about that. Seccomp filters around qemu would be nice as well.

Investigation is needed to:

• split the isolation features in "outer" vs "inner" (relative to where we'd apply them, outside or inside the VM)
• define reasonable confinement to limit the damage of VM escapes.

Copied from original issue: intel/cc-oci-runtime#246

[jcvenegas]

From @dlespiau on September 9, 2016 14:14

Adding Anthony to the discussion, he'll probably have some good input for the qemu side of things.

[jcvenegas]

From @anthonyzxu on September 13, 2016 0:43

Can we run CC inside container? then we can use cgroup ACL for CC.
we may need to figure out how to handle root disk, how to put it into container file system, will symbolic link or hard link work if root disk is a shared image?

[jcvenegas]

From @grahamwhaley on September 13, 2016 9:31

Hi @anthonyzxu Yes, we have considered running QEMU inside a container if that is needed to provide any of the required functionality - if that is the best way to provide it. Although I think we all agree it may 'feel a little odd', using a container space to wrap the VM that is providing a method to run containers in VMs, if there is a feature/method we need that is only really viable (or most efficient/effective) via a container space, then we should probably go that route.
Once we have worked out which features are best implemented in the Outside/Inside spaces then we can make the call.

[jcvenegas]

From @anthonyzxu on September 13, 2016 23:33

https://github.com/rancher/vm
RancherVM allows you to create a special kind of containers called VM Containers. A VM container looks and feels like a regular container.

Maybe we can leverage their efforts.

[jcvenegas]

From @anthonyzxu on September 13, 2016 23:35

Seems they use runc to start the VM container

[egernst]

@jcvenegas - I'm wondering if this issue can be closed? I think we have other proposals for resource management opened, and I'm not sure if we're looking at improved isolation?