NanoVMs

NanoVMs - no users, no login, single application unikernel vms. Protecting everyones cloud.

Faster than Docker, Faster than Linux.

[NanoVMs @nanovms]

microvm sandbox providers have the precise security profile of an ec2 t2.small

as in they don't add shit

should we remind them the last time some stupid dipshits tried this?

[NanoVMs @nanovms]

there's been a slew of kvm vulns recently but some ppl don't know how to properly push their agenda that is a faulty understanding of computers properly; would be hilarious if all the drama was just a rehash of the nested virt ones earlier this year

[NanoVMs @nanovms]

this wk on the unikernel application spotlight we chk out salt, a systems language with z-3 proven contracts https://t.co/HYGa1mULT9

[NanoVMs @nanovms]

@tfolbrecht https://t.co/Goz0j0FQvJ

[NanoVMs @nanovms]

looks like it's off to the retirement home for gvisor

[NanoVMs @nanovms]

since there are now over a 100 "microvm sandbox" providers out there - we ask - do they actually provide any more security than a normal t2.small on aws?

we use our excellent graphix eng dept to find out!

[NanoVMs @nanovms]

it's not really a sandbox if you can just dl random programs from the internet and run them is it? not surprising language from a bunch of losers that "don't read code anymore"

[NanoVMs @nanovms]

several?

[NanoVMs @nanovms]

Unikernels: Is it the end of containers? - via @nerdearla https://t.co/9w54Bc6wIP

[NanoVMs @nanovms]

@jundoima @OmarchyLinux since it's desktop/end-user focused kinda in a diff category - nanos is built for server-side applications

[NanoVMs @nanovms]

if you were designing an os in 2026 it might not even have users or the ability to run other programs other then the one you want to run

[Ayaan 🐧 @twtayaan]

A Google researcher says the Windows NT kernel still “puts Linux to shame” in many ways.

Laurie Kirk, a former Microsoft reverse engineer, argues that NT was built with a cleaner and more consistent security model.

Linux took a different path, adding capabilities, namespaces, cgroups and SELinux over time.

But her most controversial point is about AI agents.

Kirk argues that Linux permissions are spread across too many mechanisms, while NT handles resources, permissions and auditing more consistently.

She even says that if we designed an OS kernel from scratch in 2026, it probably wouldn’t look like Linux.

Linux engineers are already pushing back, defending the modular approach that helped Linux dominate servers, cloud and containers.

Windows vs Linux just got interesting again.

Full story: https://t.co/AaEj3YAGE0

[NanoVMs @nanovms]

this week on the unikernel application spotlight we issue some certs with pebble, an acme server via @letsencrypt https://t.co/PMj9ANcwn4

[NanoVMs @nanovms]

@besodemieterd unikernels don't require custom orchestrators as they are deployed straight to the cloud; but comparing to containers security - https://t.co/yFKoDdMzEU - for actual deploys https://t.co/2er8VBPb1K

[NanoVMs @nanovms]

a) using containers for "sandboxing" is bad for your health

b) cves being issued for vulns disclosed over a month ago means you need better defense than silly little scanners

[NanoVMs @nanovms]

another picture perfect reason why you can't rely on scanning, patching .. and why containers do not contain - over a month this container escape has been known and not fixed in popular distros like ubuntu

[NanoVMs @nanovms]

@BeardOps @dysinger a lot of projects in the space knew nothing about security and so totally disregarded page permissions - we wrote in response to this - def. been a few years https://t.co/BhgJycAsgE see also https://t.co/d2hu0lVPJf

[NanoVMs @nanovms]

@LiveOverflow @Markak_ an extremely dated concept from the 1970s that makes no sense in the cloud era where each "computer" is actually virtual

[NanoVMs @nanovms]

%s/are no longer/never have been/

[Zhenpeng (Leo) Lin @Markak_]

Containers are no longer a security boundary.

Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.

As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.

Read our full writeup: https://t.co/ZFSQCMCN73

[Joel Eriksson @OwariDa]

Containers are a useful primitive, but very limited in terms of an actual security boundary

Back in 2007 when me and my team presented at BlackHat and DefCon about our kernel exploitation research and demonstrated various 0-days and N-days for different operating systems it was cutting edge

In 2026, when AI agents are able to automate a large part of the process, kernel exploitation is becoming pretty mainstream

Physical separation (dedicated systems for each workload) is always best, but at the very least use virtualization and avoid exposing the attack surface from your host kernel to anything you want to isolate

[NanoVMs @nanovms]

@mktpavlenko @GeoffreyHuntley at least for nanos it only runs one and only one program - the shell by definition allows you to run many different programs so doesn't really work there