I wrote this because I kept seeing developers (myself included) confuse language-level isolation like Python venv with OS-level isolation like Docker. I wanted to trace the actual technical boundaries between them.

The article maps out the differences between common execution environments—from physical bare metal and VMs to containers, process sandboxes, and virtual environments—to create a mental model of where the "isolation boundary" actually sits for each tool.

▲

ianand 6 hours ago | parent | next [-]

Since you mention serverless it might be worth mentioning firecracker and v8 isolates.

▲

pjmlp 5 hours ago | parent | next [-]

Or CGIs running on httpd inside HP-UX Vaults, that is how old the idea happens to be.

	▲	ignoramous 4 minutes ago \| parent [-]
		> how old the idea happens to be TFA is missing a host of present-day isolation techniques like Isolates, Enclaves, Exclaves, Domains/Worlds, SEEs/TEEs, SEs, HSMs ...

▲

ThierryBuilds 6 hours ago | parent | prev [-]

Thank you for the feedback. I will definitely add them as example solutions for serverless.

▲

fuzzfactor an hour ago | parent | prev | next [-]

>1. Physical Machine (Bare Metal) This is the foundation.

Nobody should ever forget this.

But I would say this next part is about the opposite for bare metal though:

>Use Case: High-performance computing (HPC), large databases, or legacy systems that require direct hardware access.

To get the utmost reliability out of adequate hardware then bare metal is more suitable for almost everything except for special situations.

Unless something is really wrong with the software or the overall hardware/software approach.

▲

lateral_cloud 5 hours ago | parent | prev [-]

Did you really write it though? Within the first paragraph it's fairly obvious this is heavily LLM-generated.

	▲	aragilar 5 hours ago \| parent [-]
		It also has weird definitions. Is nix a virtual environment? Is homebrew a virtual environment? Why is a sandbox different to a container? Type-1 vs Type-2 hypervisors are quite different, and there's no discussion about processes vs threads.