Goldilocks Isolation: High Performance VMs with Edera · HackerPapers discussions

Goldilocks Isolation: High Performance VMs with Edera — mentioned by alexzenla

Wed, 04 Feb 2026 18:53:40 GMT

This is the thesis of our research paper here, a good middle ground is necessary: https://arxiv.org/abs/2501.04580

Paper and discussion history. A mention is not an endorsement.

Goldilocks Isolation: High Performance VMs with Edera — mentioned by sys_call

Thu, 27 Mar 2025 14:40:21 GMT

gVisor runs a userspace kernel that proxies syscalls to a shared host kernel. Running an "application kernel" in userspace impacts performance because it goes through two schedulers. Virtual machine isolation is more restrictive because it doesn't share any kernel state with other containers. We have a whitepaper that compares the performance of gVisor and Stylorite/Edera if you want to see the differences http://arxiv.org/abs/2501.04580

Paper and discussion history. A mention is not an endorsement.

Goldilocks Isolation: High Performance VMs with Edera — mentioned by sys_call

Thu, 27 Mar 2025 14:34:39 GMT

gVisor emulates a kernel in userspace, providing some isolation but still relying on a shared host kernel. The recent Nvidia GPU container toolkit vulnerability was able to privilege escalate and container escape to the host because of a shared inode. Styrolite runs containers in a fully isolated virtual machine guest with its own, non-shared kernel, isolated from the host kernel. Styrolite doesn't run a userspace kernel that traps syscalls; it runs a type 1 hypervisor for better performance and security. You can read more in our whitepaper: http://arxiv.org/abs/2501.04580

Paper and discussion history. A mention is not an endorsement.