Firecracker, io_uring and validating layers of defense
A few months ago, a quiet patch was merged into Firecracker that fixed a security issue that impacts aarch64 only. It’s a vulnerability in Firecracker’s jailer process that I’ll describe in a minute. I thought it would be fun to explore what would have happened if this class of vulnerability impacted Firecracker in the future. The specific PR from Amazon is: #5956 What is the Jailer The Jailer for Firecracker is what’s sometimes called the “supervisor” in other sandboxes. For Android that was the zygote process, for containers that was the shim. It’s a process that is responsible for setting up the isolation environment before it gets executed.
