Finally organized my thoughts into a blog post around the state of hypervisors in my home lab, with some new hardware. I also called out a few nice features of XCP-NG and Proxmox that I discovered while I was evaluating both of them.
https://medium.com/@a.j.longchamps/home-lab-hardware-refresh-september-2025-edition-3e50767b63e1
#homelab #hardware #hypervisors #ansible #automation #debian #kubernetes #learning #tinkering #proxmox #xcpng #minisforum
A Fuzzy Escape - A tale of #vulnerability research on #hypervisors
Conceptual conflation, in a bunch of paragraphs.
This is not how it works.
https://thenewstack.io/bare-metal-kubernetes-the-performance-advantage-is-almost-gone/
Supposed "hard" limits can as well be enforced with #containerization. It is just less common and not necessarily desired.
And no, those limits are not hard, and no, #hypervisors do not guarantee isolation either - see e.g. all the recently revealed #VMWare bugs with integer overflows and underflows, array out-of-bound accesses etc..
⚠️ Just a reminder, folks:
The "container" movement on Linux emerged as a convenient way to manage different, possibly conflicting settings & dependencies for different apps on a machine. "Security" by sandboxing got tacked on later, and the quality of that isolation remains LOW regardless of all the trendy project names and acronyms that have filled that space.
Data centers' standard for high security consists of virtual machines (type 1 hypervisors) or separate dedicated hardware. Ain't no way, no how is a successful datacenter going to ask a giant, complex, contorted Linux or BSD (or hybrid Windows or Mac) kernel for sandboxing services to contain threats.
If you are using containers to enhance security – on any general-purpose machine – make sure they are running as VMs, or as sandboxes on a microkernel (not monolithic) architecture.
#infosec #security #containers #hypervisors #microkernel