YHK - yet another hacker news clone

Greg Kurtzer's Ginux is now a userspace kernel

45 points d3Xt3r 2 hours ago 21 comments

up2isomorphism 1 hour ago | parent

The issue with this kind of thing is nobody will take it seriously.

mbreese 1 hour ago | parent

Why? Because a user space kernel is a bad idea? Or because of the AI use when writing it?

I’m still trying to figure out exactly what it is.

up2isomorphism 1 hour ago | parent

Why should someone spend anytime on this kind of technical piece that is not created by human? Think about what you will get from this, the answer is pretty obvious.

luckystarr 34 minutes ago | parent

No obvious to me, sorry. What will I get from this?

shevy-java 24 minutes ago | parent

Well, one obvious issue is that this is controlled not by humans, whereas the linux kernel is. What if the parent company changes things with regards to the AI here? You may have to pay more suddenly.

You could probably work around this partially by having contracts with people, but these in turn also depend on the AI slop then, so the problem is just shifted.

jeroenhd 21 minutes ago | parent

A userspace kernel is already pretty niche. Not many people will get anything serious out of it.

The slop problem is also a challenge to overcome. The project barely existed and has already pivoted in a completely new direction. Who knows when this direction bores the author and we get yet another pivot. Or the author loses interest and we end up with a dead pile of abandoned code like so many other LLM generated projects.

The previous state of the project could've made for an interesting VM runtime (safety of Rust without the issues that come with the lack of ported drivers). For this new direction, I don't think there's a similar sort of demand.

Stating that nobody will take it seriously is probably an exaggeration, but I consider these projects to be toys for the author to play with, I don't see why you would take more interest than going "huh, neat I guess".

asdfsa32 1 hour ago | parent

This is kind of the wrong approach when linux namespaces exist and rootless namespaces are approach full spectrum.

stingraycharles 1 hour ago | parent

I’m still fascinated by the approach, though. It seems to me that it sits somewhere between cgroups and virtual machines.

I do wonder what problem it solves, as I don’t think that it provides the same security guarantees that micro-VMs like firecracker do?

eddythompson80 1 hour ago | parent

It’s the same approach as gVisor. Fairly decent isolation if your application can work on it, but your SOL if a scenario comes up that doesn’t work. VMs give you pretty much 100% Linux compatibility at the expense of density, optimal resource allocation and startup time. gVisor gives you excellent startup time, resource allocation and density at the expense of some app compat and performance at the extremes

Edit: at least with gvisor you get close to a decade of work on compat. gVisor can support some rootless containers scenarios and systemd these days.

photios 54 minutes ago | parent

I wonder if this can grow into a capability-based security tool.

mbreese 48 minutes ago | parent

I’d be very interested in it if it started to approach VM style isolation without needing KVM access (or qemu).

But I’m not sure if that is really possible.

The use case I’m thinking about is a sandbox exec isolation on an HPC cluster without Docker. I know singularity/apptainer exist, but I’m always looking for something that could make that environment more flexible. It is a tight security environment, so we are always limited in what we can do.

eddythompson80 26 minutes ago | parent

It all becomes a religion to some people. hypervisor escapes are a thing. People always point to Vt-x or AMD-V as having stood the test of time, and that might be true, but the software layer on top certainly hasn’t. Yet you will have “security professionals” tell you that you can’t trust anything beyond a hypervisor. Or they might tell you that a user space kernel is just as secure. They might tell you KVM is a no-go because of bad Type1/Type2 hybrid architecture compared to Xen or HyperV Type1. All have had their fair share of vulnerabilities over the years. All less than Linux process isolation, but still.

photios 56 minutes ago | parent

> Telling someone's research and exploration is wrong...

Never change, HN, never change :D

nessex 34 minutes ago | parent

Isn't this also adding a capability sort of like OpenBSD's pledge?

worthless-trash 28 minutes ago | parent

If it has to go through another layer , hopefully without ring0 privs, which more than likely may filter out a number of exploit vectors, how is this the wrong approach ?

Breaking this layer doesn;t automatically give ring0 privs across the hardware.

weinzierl 28 minutes ago | parent

The Linux kernel is a gigantic attack surface with a ton of legacy stuff most modern applications will never need. Namespaces do not really help with this, but userspace kernels can. (Haven't looked into Ginux enough to know if it does.)

That is also why I believe the namespace approach, and by extension Docker-like containerization, is a dead end when it comes to isolation. I hope something like gVisor will win.

This is even more important since agents have turned isolation from a datacenter topic into everyone's concern.

TnS-hun 45 minutes ago | parent

Post from yesterday: https://news.ycombinator.com/item?id=50424147

ajasmin 20 minutes ago | parent

Talk about pivoting. I guess that's what you call lean and agile.

hkt 33 minutes ago | parent

My immediate thought was this: https://en.wikipedia.org/wiki/User-mode_Linux

More seriously, it is a great use of indirection insofar as replacing the full Linux kernel is a gargantuan task. A userspace kernel per task or task group.. makes a lot of sense. I'd be interested to know how it captures syscalls - eBPF? It wasn't obvious from a skim of the readme.

This kind of give-me-this-interface work seems pretty perfect for LLMs, too.

shevy-java 26 minutes ago | parent

Guys - AI slop is winning the war. Soon the Top 500 Supercomputers will run AI-Ginux rather than Linus-Linux.

ajasmin 17 minutes ago | parent

So how exactly can you control multiple isolated address spaces for the leaf user processes and how do you handle syscalls? Does the host kernel have facilities for normal user processes to do so?