Hacker News Reader

Comment by ec109685 | Hacker News Reader

I still don’t know why Google has gvisor and AWS has firecracker. Isn’t the firecracker approach strictly better than Google’s approach?

View on HN

Firecracker is hardware-based virtualization. gVisor is not virtualization at all but more like advanced sandboxing - it intercepts syscalls and proxies them on processeses behalf. That means gVisor is slower on i/o (which this new feature is trying to solve) but it also means it’s easier to implement and operate and you can run it in more environments (for examples in VMs where nested virtualization is not supported).

What are the reasons these days to not enable nested virtualization? I know AWS doesn’t.

Afaik their hardware just didnt support it, not sure why it’s still not supported at this day and age.

Performance used to be a problem with nested virt but afaik both hw and software have caught up

If you want to join us in the peanut gallery, AWS originally "adapted" Google's crosvm for firecracker.

gVisor, if not using hw-backed virtualization, has absolutely horrendous performance because of, amongst other things, ptrace, which is one reason why this blogpost exists.

Note that ptrace is only one platform and it’s no longer even the default. It’s been replaced by systrap. When running on bare metal, the KVM platform provides the best performance: https://gvisor.dev/docs/architecture_guide/platforms/

Outside of the peanut gallery we just roll our own VMM, VMX and friends is well established at this point why settle for a hacky impl.?

This sort of feels like seeing someone riding a bike and saying: why don’t they just get a car? The simple fact is that containers and VMs are quite different.

I’m responding to what I believe is the intent of the comment, but I will also point out that on a literal level it doesn’t make sense. Whether something uses VMX and friends or not is a red herring, as gVisor also “rolls it own” VMM [1] and certainly makes use of VMX and friends.

[1] https://github.com/google/gvisor/tree/master/pkg/sentry/plat...

Apologies my reply was toward Firecracker, I appreciate gVisor is a sandbox solution/KVM shim rather than a true VMM.

Ah, now it makes more sense to me. Thank you for the clarification.

Firecracker may be better but it's irrelevant if I cannot use it in my environment.

In particular firecracker runs on bare metal or VMs that support nested virtualization, which unfortunately is not widely available in the clouds (and bare metal is expensive)

Firescracker is good and all but if one wants to use it, one has to change its ecosystem, it’s communication with other servers, why change your entire ecosystem for one tool or just build a tool to fit your ecosystem, and really like the concept of firecracker-containerd but still need some modifications and also I wouldn’t expect Google to put their entire Cloud Run, App engine under the hands of aws (even tho it’s FOSS)

Firecracker does not work with long running process. It's only good for function as a service / serverless stuff.

What is your definition of long running processes?

AWS Fargate (containers as a service for ECS/EKS) uses Firecracker under the hood, and you can easily have the container up for weeks, and probably even for months.

Similarly, Fly.io also uses Firecracker, and again, you can have weeks/months long uptime on containers.

Reply on news.ycombinator.com