Hacker News Reader

I mean sure, but virtualization is a very robust (and much lower overhead) technology that is readily available (and supported by the processor). If you just want isolation, why wouldn't you use that? You still have to ship a compiled binary after all.

View on HN

If you just want to run some CPU bound code as fast as possible, virtualisation has low overhead.

But if you are doing a lot of communication between the script and the host system, I'm not sure virtualisation does so well?

No, as the author of TinyKVM, the overheads of entering and leaving KVM is not the same order of magnitude as SFI. TinyKVM requires 2-3 microseconds to enter and leave, which is the lowest I ever managed to get while it still being robust and dependable sandbox. For some, that might seem really low, but keep in mind that libriscv which is the backbone of RVScript has 3 nanoseconds overhead.

Thanks!

Reply on news.ycombinator.com