Fascinating how ai-assisted vulnerability discovery is changing the landscape I got used to with docker.
MicroVMs >> Containers ?
What even are microVMs and why ?
Let's first understand in short what containers are: 'The Illusion Of Isolation'
Containers don't run a new OS, they just use kernel namespaces (clone(), chroot) to fake it, which has it's benifits like fast startup, build, deploy etc.
Every container shares the exact same Linux kernel.
In cloud environments (like K8s or AWS ECS), a malicious app in tenant A's container can exploit a kernel bug to escape to the host, gaining access to your container's memory, secrets, and data.
Kernel zero-days like Dirty COW used to happen once every couple of years.
Now, AI-assisted research is surfacing whole new classes of local privilege escalation (LPE) bugs every few months, making patching a losing race against breakouts.
Is there a solution ??
--> MicroVMs 🔐 <--
Instead of sharing a kernel, microVMs leverage CPU hardware virtualization, to give every workload its own hardware-enforced memory address space and dedicated kernel.
Containers are great for packaging apps. But for running untrusted code, hardware-isolated microVMs are becoming mandatory.