Surely the fact that one is running a "a partially emulated guest kernel" as you put it vs a real linux kernel makes them sufficiently different, no?

I haven't used gVisor in a while, but could you mount an NFS or CIFS share on gvisor or can you manage nftables, seccomp, namespaces, etc? At least that didn't use to be possible. So depending on the solution you're trying to provide, there was a big difference.

▲

tptacek 3 days ago | parent [-]

Who cares? The overwhelming majority of cloud customers just want to run straightforward Node.js apps.

▲

oooyay 3 days ago | parent | next [-]

> Who cares? The overwhelming majority of cloud customers just want to run straightforward Node.js apps.

The security professionals whose sentiments you were describing would surely care. I was answering as a software engineer that often works at this level of security. I would and do care.

▲

eddythompson80 3 days ago | parent | prev [-]

In my experience, someone will eventually care, especially in enterprises or large orgs that don’t know what they are doing, then want to run dockerd or mount a share from some legacy system. Then the problem becomes do you lose that class of users or do you build 2 backends (A gVisor and a kvm/firecracker/etc) or just build a kvm one.

Google tried to do their Cloud Run gvisor only, then 2 years later switched to a hypervisor (though I don’t know if they use kvm or something else). That has been my experience also in trying to run an “emulated” Linux anything. Eventually some tough compat issue arrises and you wish you had just ran the real thing and figured all the issues with that instead. Tbf, gVisor offers much better density and much easier resource management etc. just the compat issues are tough unless you’re willing to (or can) say no to some scenarios.

	▲	tptacek 3 days ago \| parent [-]
		I just don't think "can you run CIFS easily under it" has much to do with whether someone like Replit should use Docker, Firecracker, or gVisor.