Videos / DevOps

Episode 14 of 14 · DevOps, end to end

Sandboxing and Firecracker: running code you do not trust

Chapters

1. Code you did not write0:00
2. Write the threat model0:16
3. The wall in silicon0:32
4. The door is very wide0:50
5. Three questions to ask1:09
6. The ladder1:26
7. Rooms in one building1:43
8. Lie one: the view1:59
9. Lie two: how much only2:19
10. Now count the kernels2:37
11. One bug and it is over2:54
12. And the defaults are kind3:12
13. Strip the bench3:31
14. Not every capability is equal3:49
15. A gate on the door4:09
16. How the allow list is built4:27
17. Three cheap, large wins4:44
18. A kernel in front of the kernel5:04
19. Give them their own building5:21
20. Where the syscall stops now5:38
21. A classic VM is enormous5:57
22. Firecracker6:15
23. Read what is missing6:33
24. What the boundary costs6:51
25. Nobody waits five seconds7:09
26. Break the number apart7:27
27. The runtime is the rest7:47
28. Snapshots8:04
29. Every clone is identical8:23
30. The warm pool8:43
31. A wall you can hear through9:02
32. The attack is a clock9:19
33. The defences are scheduling9:38
34. The loud neighbour9:56
35. The limits you use every day10:14
36. The one nobody sets10:31
37. The whole thing10:51

Sandboxing and Firecracker: running code you do not trust. Someone hands you code and asks you to run it. A pull request from a stranger. A cell in a shared notebook. A function a customer uploaded. Something a model just generated. You ha

Mark as watchedSaved in this browser only.