diff --git a/website/_config.yml b/website/_config.yml index 5679a5552..9304cd784 100644 --- a/website/_config.yml +++ b/website/_config.yml @@ -15,6 +15,8 @@ plugins: - jekyll-sitemap site_url: https://gvisor.dev feed: + title: "gVisor blog" + url: https://gvisor.dev path: blog/index.xml svg: optimize: true diff --git a/website/blog/2019-11-18-security-basics.md b/website/blog/2019-11-18-security-basics.md index 938605cc2..c75687e6a 100644 --- a/website/blog/2019-11-18-security-basics.md +++ b/website/blog/2019-11-18-security-basics.md @@ -16,6 +16,8 @@ and _platform portability_ (run gVisor wherever Linux OCI containers run). Delivering on each of these goals requires careful security considerations and a robust design. + + ## What does "sandbox" mean? gVisor allows the execution of untrusted containers, preventing them from diff --git a/website/blog/2020-04-02-networking-security.md b/website/blog/2020-04-02-networking-security.md index f3ce02d11..a887f7080 100644 --- a/website/blog/2020-04-02-networking-security.md +++ b/website/blog/2020-04-02-networking-security.md @@ -8,6 +8,8 @@ networking architecture of gVisor, and the tradeoffs involved. In particular, we will cover how these principles culminated in two networking modes, how they work, and the properties of each. + + ## gVisor's security architecture in the context of networking Linux networking is complicated. The TCP protocol is over 40 years old, and has diff --git a/website/blog/2020-09-18-containing-a-real-vulnerability.md b/website/blog/2020-09-18-containing-a-real-vulnerability.md index 8a6f7bbf1..d3802cb19 100644 --- a/website/blog/2020-09-18-containing-a-real-vulnerability.md +++ b/website/blog/2020-09-18-containing-a-real-vulnerability.md @@ -13,6 +13,8 @@ gVisor's security. While gVisor is not immune to vulnerabilities, [we take several steps](https://gvisor.dev/security/) to minimize the impact and remediate if a vulnerability is found. + + ## Escaping the Container First, let’s describe how the discovered vulnerability works. There are numerous diff --git a/website/blog/2020-10-22-platform-portability.md b/website/blog/2020-10-22-platform-portability.md index 15a804b52..85a9e9a74 100644 --- a/website/blog/2020-10-22-platform-portability.md +++ b/website/blog/2020-10-22-platform-portability.md @@ -6,6 +6,8 @@ requires expensive bare-metal machines or cloud instances to run safely with good performance, increasing cost and complexity for Cloud users. gVisor, however, takes a more flexible approach. + + **NOTE 2024-05**: This post describes the ptrace and KVM platforms, which were the only two gVisor platforms at the time it was written. The [Systrap platform](/blog/2023/04/28/systrap-release/) was added since and diff --git a/website/blog/2021-08-31-gvisor-rack.md b/website/blog/2021-08-31-gvisor-rack.md index e7d4582e4..757b97bfd 100644 --- a/website/blog/2021-08-31-gvisor-rack.md +++ b/website/blog/2021-08-31-gvisor-rack.md @@ -4,6 +4,8 @@ gVisor has implemented the [RACK](https://datatracker.ietf.org/doc/html/rfc8985) (Recent ACKnowledgement) TCP loss-detection algorithm in our network stack, which improves throughput in the presence of packet loss and reordering. + + TCP is a connection-oriented protocol that detects and recovers from loss by retransmitting packets. [RACK](https://datatracker.ietf.org/doc/html/rfc8985) is one of the recent loss-detection methods implemented in Linux and BSD, which diff --git a/website/blog/2021-12-02-running-gvisor-in-production-at-scale-in-ant.md b/website/blog/2021-12-02-running-gvisor-in-production-at-scale-in-ant.md index d00e7e058..39d74e0e8 100644 --- a/website/blog/2021-12-02-running-gvisor-in-production-at-scale-in-ant.md +++ b/website/blog/2021-12-02-running-gvisor-in-production-at-scale-in-ant.md @@ -10,6 +10,8 @@ many measures. As a container runtime, gVisor provides container-native security without sacrificing resource efficiency. Therefore, it has been on our radar since it was released. + + However, there have been performance concerns raised by members of [academia](https://www.usenix.org/system/files/hotcloud19-paper-young.pdf) and [industry](https://news.ycombinator.com/item?id=19924036). Users of gVisor tend diff --git a/website/blog/2022-08-31-threat-detection.md b/website/blog/2022-08-31-threat-detection.md index 1559877bc..d99e670f8 100644 --- a/website/blog/2022-08-31-threat-detection.md +++ b/website/blog/2022-08-31-threat-detection.md @@ -9,6 +9,8 @@ provides the ability for an external process to observe application behavior and detect threats at runtime. Using this mechanism, gVisor users can watch actions performed by the container and generate alerts when something unexpected occurs. + + A monitoring process can connect to the gVisor sandbox and receive a stream of actions that the application is performing. The monitoring process decides what actions are allowed and what steps to take based on policies for the given diff --git a/website/blog/2022-10-24-buffer-pooling.md b/website/blog/2022-10-24-buffer-pooling.md index 99cbe04f6..ea566860e 100644 --- a/website/blog/2022-10-24-buffer-pooling.md +++ b/website/blog/2022-10-24-buffer-pooling.md @@ -10,6 +10,8 @@ gVisor can do all packet processing internally and only has to enable a few host I/O syscalls for near-complete networking capabilities. This keeps gVisor’s exposure to host vulnerabilities as narrow as possible. + + Although writing Netstack in Go was important for runtime safety, up until now it had an undeniable performance cost. iperf benchmarks showed Netstack was spending between 20-30% of its processing time allocating memory and pausing for diff --git a/website/blog/2023-04-28-systrap-release.md b/website/blog/2023-04-28-systrap-release.md index 0b32ff012..cca27245f 100644 --- a/website/blog/2023-04-28-systrap-release.md +++ b/website/blog/2023-04-28-systrap-release.md @@ -6,7 +6,7 @@ virtualization. Unlike the ptrace platform, it’s fast 🚀. Go try it by addin `--platform=systrap` to the runsc flags. If you want to know more about it, read on. --------------------------------------------------------------------------------- + gVisor is a security boundary for arbitrary Linux processes. Boundaries do not come for free, and gVisor imposes some performance overhead on sandboxed diff --git a/website/blog/2023-05-08-rootfs-overlay.md b/website/blog/2023-05-08-rootfs-overlay.md index bca8fc9f0..5ace582a3 100644 --- a/website/blog/2023-05-08-rootfs-overlay.md +++ b/website/blog/2023-05-08-rootfs-overlay.md @@ -6,7 +6,7 @@ a tmpfs filesystem. Learn more about this feature in the following blog that was [originally posted](https://opensource.googleblog.com/2023/04/gvisor-improves-performance-with-root-filesystem-overlay.html) on [Google Open Source Blog](https://opensource.googleblog.com/). --------------------------------------------------------------------------------- + ## Costly Filesystem Access diff --git a/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md b/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md index 2da4781b0..63a230f2b 100644 --- a/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md +++ b/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md @@ -7,12 +7,13 @@ generate images using a GPU from within gVisor. Both the and the [PyTorch] code used by Stable Diffusion were run entirely within gVisor while being able to leverage the NVIDIA GPU. + + ![A sandboxed GPU](/assets/images/2023-06-20-sandboxed-gpu.png "A sandboxed GPU.") **Sand**boxing a GPU. Generated with Stable Diffusion v1.5.
This picture gets a lot deeper once you realize that GPUs are made out of sand. --------------------------------------------------------------------------------- ## Disclaimer diff --git a/website/blog/2023-06-27-directfs.md b/website/blog/2023-06-27-directfs.md index 330f890eb..f7f75faac 100644 --- a/website/blog/2023-06-27-directfs.md +++ b/website/blog/2023-06-27-directfs.md @@ -7,7 +7,7 @@ the following blog that was [originally posted](https://opensource.googleblog.com/2023/06/optimizing-gvisor-filesystems-with-directfs.html) on [Google Open Source Blog](https://opensource.googleblog.com/). --------------------------------------------------------------------------------- + ## Origins of the Gofer diff --git a/website/blog/2024-02-01-seccomp.md b/website/blog/2024-02-01-seccomp.md index 4c386ea5b..58ba845b9 100644 --- a/website/blog/2024-02-01-seccomp.md +++ b/website/blog/2024-02-01-seccomp.md @@ -10,14 +10,14 @@ is actually executed. **This blog post contains more than you ever wanted to know about `seccomp-bpf`, and explores the past few months of work to optimize gVisor's use of it.** + + ![gVisor and seccomp](/assets/images/2024-02-01-gvisor-seccomp.png "gVisor and seccomp"){:style="max-width:100%"} A diagram showing gVisor's two main layers of security: gVisor itself, and `seccomp-bpf`. This blog post touches on the `seccomp-bpf` part. [Tux logo by Larry Ewing and The GIMP](https://commons.wikimedia.org/wiki/File:Tux.svg). --------------------------------------------------------------------------------- - ## Understanding `seccomp-bpf` performance in gVisor {#performance-considerations} One challenge with gVisor performance improvement ideas is that it is often very diff --git a/website/blog/index.html b/website/blog/index.html index 272917fc4..9667a0b60 100644 --- a/website/blog/index.html +++ b/website/blog/index.html @@ -12,8 +12,8 @@ pagination:
{% include byline.html authors=post.authors date=post.date %}
-

{{ post.excerpt | strip_html }}

-

Full Post »

+

{{ post.excerpt }}

+

Read more »

{% endfor %} diff --git a/website/defs.bzl b/website/defs.bzl index 1eaaccf0b..9de6287f4 100644 --- a/website/defs.bzl +++ b/website/defs.bzl @@ -146,7 +146,8 @@ include_in_menu: {include_in_menu}""" builder_content.append("title=\"$(grep -E '^# ' %s | head -n 1 | cut -d'#' -f2- || true)\"" % f.path) builder_content.append("cat >$T/%s <'") builder_content.append(header.format(**args)) builder_content.append("---") builder_content.append("EOF")