site update: cover art for the learn-site case studies; publish untrusted-in-a-vm (SECURITY #7)
build-and-deploy / build (push) Failing after 11m8s
build-and-deploy / build (push) Failing after 11m8s
This commit is contained in:
Binary file not shown.
|
After Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 60 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
@@ -0,0 +1,69 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="440" viewBox="0 0 1180 440" role="img" aria-label="Two isolation models compared. Left: three containers as processes sharing one host kernel, separated only by dotted namespace lines - an escape lands on the host. Right: each pod boots inside its own microVM with its own guest kernel behind the hardware hypervisor - an escape lands inside a disposable virtual machine, not on the host.">
|
||||
<rect width="1180" height="440" fill="#ffffff"></rect>
|
||||
|
||||
<!-- titles -->
|
||||
<text x="60" y="52" font-family="ui-monospace,Menlo,Consolas,monospace" font-size="17" font-weight="600" fill="#0f172a">namespaces: one shared kernel</text>
|
||||
<text x="640" y="52" font-family="ui-monospace,Menlo,Consolas,monospace" font-size="17" font-weight="600" fill="#0f172a">Kata: a kernel per pod</text>
|
||||
|
||||
<!-- ===== LEFT: shared kernel ===== -->
|
||||
<!-- three container processes, dotted separations -->
|
||||
<g font-family="ui-monospace,Menlo,Consolas,monospace" font-size="14" text-anchor="middle">
|
||||
<rect x="60" y="84" width="130" height="86" rx="8" fill="none" stroke="#0c8fce" stroke-width="2" stroke-dasharray="6 5"/>
|
||||
<text x="125" y="122" fill="#0f172a">container</text><text x="125" y="142" fill="#64748b">process</text>
|
||||
<rect x="215" y="84" width="130" height="86" rx="8" fill="none" stroke="#0c8fce" stroke-width="2" stroke-dasharray="6 5"/>
|
||||
<text x="280" y="122" fill="#0f172a">container</text><text x="280" y="142" fill="#64748b">process</text>
|
||||
<rect x="370" y="84" width="130" height="86" rx="8" fill="none" stroke="#c026d3" stroke-width="2" stroke-dasharray="6 5"/>
|
||||
<text x="435" y="122" fill="#0f172a">untrusted</text><text x="435" y="142" fill="#64748b">process</text>
|
||||
<!-- escape arrow: through the dotted floor into the kernel -->
|
||||
<path d="M435 172 L435 208" stroke="#c026d3" stroke-width="2.5" marker-end="url(#am)"/>
|
||||
<text x="522" y="196" fill="#c026d3" font-size="13">escape = host</text>
|
||||
<!-- one kernel slab -->
|
||||
<rect x="60" y="214" width="440" height="64" rx="8" fill="#eef2f7" stroke="#334155" stroke-width="2"/>
|
||||
<text x="280" y="242" fill="#0f172a" font-weight="600">ONE host kernel</text>
|
||||
<text x="280" y="262" fill="#64748b">shared by every container and the node</text>
|
||||
<!-- host hardware -->
|
||||
<rect x="60" y="292" width="440" height="46" rx="8" fill="none" stroke="#94a3b8" stroke-width="2"/>
|
||||
<text x="280" y="321" fill="#64748b">host hardware</text>
|
||||
<text x="280" y="376" fill="#64748b" font-size="13">dotted lines are namespaces:</text>
|
||||
<text x="280" y="396" fill="#64748b" font-size="13">visibility control, not a security boundary</text>
|
||||
</g>
|
||||
|
||||
<!-- ===== RIGHT: kata microVMs ===== -->
|
||||
<g font-family="ui-monospace,Menlo,Consolas,monospace" font-size="14" text-anchor="middle">
|
||||
<!-- two microVMs, solid walls, each with its own guest kernel -->
|
||||
<g>
|
||||
<rect x="640" y="84" width="220" height="150" rx="10" fill="none" stroke="#334155" stroke-width="3"/>
|
||||
<text x="750" y="112" fill="#0f172a">pod</text>
|
||||
<rect x="662" y="126" width="176" height="42" rx="6" fill="none" stroke="#0c8fce" stroke-width="2"/>
|
||||
<text x="750" y="152" fill="#0f172a">container process</text>
|
||||
<rect x="662" y="180" width="176" height="38" rx="6" fill="#eef2f7" stroke="#7c3aed" stroke-width="2"/>
|
||||
<text x="750" y="204" fill="#7c3aed">own guest kernel</text>
|
||||
</g>
|
||||
<g>
|
||||
<rect x="890" y="84" width="220" height="150" rx="10" fill="none" stroke="#334155" stroke-width="3"/>
|
||||
<text x="1000" y="112" fill="#0f172a">untrusted pod</text>
|
||||
<rect x="912" y="126" width="176" height="42" rx="6" fill="none" stroke="#c026d3" stroke-width="2"/>
|
||||
<text x="1000" y="152" fill="#0f172a">agent process</text>
|
||||
<rect x="912" y="180" width="176" height="38" rx="6" fill="#eef2f7" stroke="#7c3aed" stroke-width="2"/>
|
||||
<text x="1000" y="204" fill="#7c3aed">own guest kernel</text>
|
||||
</g>
|
||||
<!-- escape arrow: contained inside the VM wall -->
|
||||
<path d="M1000 160 Q 1052 168 1046 186" fill="none" stroke="#c026d3" stroke-width="2.5" marker-end="url(#am)"/>
|
||||
<text x="1010" y="256" fill="#c026d3" font-size="13">escape = still inside a throwaway VM</text>
|
||||
<!-- hypervisor + hardware -->
|
||||
<rect x="640" y="272" width="470" height="46" rx="8" fill="#eef2f7" stroke="#334155" stroke-width="2"/>
|
||||
<text x="875" y="301" fill="#0f172a" font-weight="600">hypervisor (KVM) - CPU-enforced boundary</text>
|
||||
<rect x="640" y="332" width="470" height="42" rx="8" fill="none" stroke="#94a3b8" stroke-width="2"/>
|
||||
<text x="875" y="359" fill="#64748b">host hardware (VT-x)</text>
|
||||
<text x="875" y="406" fill="#64748b" font-size="13">runtimeClassName: kata - same kubectl, different boundary</text>
|
||||
</g>
|
||||
|
||||
<!-- divider -->
|
||||
<line x1="573" y1="70" x2="573" y2="400" stroke="#e2e8f0" stroke-width="2"/>
|
||||
|
||||
<defs>
|
||||
<marker id="am" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto">
|
||||
<path d="M0 0L10 5L0 10z" fill="#c026d3"/>
|
||||
</marker>
|
||||
</defs>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 5.0 KiB |
Reference in New Issue
Block a user