Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

I'm curious what the performance impact is like; I assume there has to be some slow down because of the interception of system calls?

View on HN

It uses Reverie under the hood, which itself relies on ptrace (at least for the current, sole implementation).

> Since ptrace adds significant overhead when the guest has a syscall-heavy workload, Reverie will add similarly-significant overhead. The slowdown depends on how many syscalls are being performed and are intercepted by the tool.

> The primary way you can improve performance with the current implementation is to implement the subscriptions callback, specifying a minimal set of syscalls that are actually required by your tool.

https://github.com/facebookexperimental/reverie

Tangent: running old OSes (with no virtio support) under QEMU on Linux has the peculiar property that I/O-heavy portions such as installation can run faster under TCG (JIT) than under KVM (hardware virtualization), presumably due to all the trapping. It’s a toss-up when those also include CPU-heavy parts (decompression).

> all thread executions are serialized so that there is effectively only one CPU

This definitely isn't intended for general-purpose sandboxing. It's an interesting tool for analysis and debugging.

Ah, I had missed that it effectively forces you to one CPU. Although I already would not use it for anything but testing account of it intentionally on unrandomizing things - I suspect, for instance, that it's unsafe to run any sort of cryptography that would create keys under this.

Reply on news.ycombinator.com