Hacker News Reader

It looks like totally overengineered solution to me. The CPU already has a protected mode which doesn't allow the program to access any files directly. Why do you need to run a VM which by the way is run from the kernel (privileged mode) in Linux? Why cannot you run untrusted programs in protected mode?

View on HN

With containers the entire surface area of the kernel is available to attack (syscalls). With a VM the surface is restricted to the VMM and KVM.

This is an oversimplification, there may be other protocols that are passed through or utilized, they would add to the surface.

Reply on news.ycombinator.com