Essentially itâs just: remove .py files an execute del os.environ[âSESSION_TOKENâ]? This doesnât really sound very secure, there are a number of ways to bypass both of these.
I think this is pretty standard and similar to approaches that are evolving naturally (I've certainly used very similar patterns).
I'd be pretty keen to actually hear more about the Unikraft setup and other deeper details about the agent sandboxes regarding the tradeoffs and optimizations made. All the components are there but has someone open-sourced a more plug-and-play setup like this?
Itâs neat to see more projects adopting Unikernals. Iâve played around with Unikraftâs Cloud offering about a year ago when it was CLI/API only and was impressed by the performance but found too many DX and polish issues to take it to production. Looks like theyâve improved a lot of that since.
The first 3 âhardeningâ points are not great.
Essentially itâs just: remove .py files an execute del os.environ[âSESSION_TOKENâ]? This doesnât really sound very secure, there are a number of ways to bypass both of these.
Itâs just security through obscurity
I think this is pretty standard and similar to approaches that are evolving naturally (I've certainly used very similar patterns).
I'd be pretty keen to actually hear more about the Unikraft setup and other deeper details about the agent sandboxes regarding the tradeoffs and optimizations made. All the components are there but has someone open-sourced a more plug-and-play setup like this?
Itâs neat to see more projects adopting Unikernals. Iâve played around with Unikraftâs Cloud offering about a year ago when it was CLI/API only and was impressed by the performance but found too many DX and polish issues to take it to production. Looks like theyâve improved a lot of that since.
maybe the usecase that makes unikernels alot more mainstream. Always found them intriguing
Except this is very clearly running linux.
What can you NOT run on this, it's not very clear? Is it like MicroVMs on steroids where you can run more binaries than the strict minimum?