Privileged Ports Are Expensive (2016)
In terms of security/isolation, processes, users, containers and virtualization are all essentially the same thing. I wish the people working on these things would step back and notice the forest for the trees.<p>Whatever the ultimate "isolation unit" ends up being, it needs to be recursive. That means being able to run processes <i>within</i> your process (essentially as libraries), create users <i>within</i> your user account (for true first-class multi-tenancy), or VMs <i>within</i> your VM (without compounding overhead).<p>It turns out that this author also wrote "Docker: Not Even a Linker"[1] which was also deeply insightful about unconscious/accidental architecture decisions. I'm impressed by his insight and disturbed that most people don't seem to understand it.<p>[1] <a href="https://news.ycombinator.com/item?id=9809912" rel="nofollow">https://news.ycombinator.com/item?id=9809912</a>