alt Hacker NewsSo how exactly can you control multiple isolated address spaces for the leaf user processes and how do you handle syscalls? Does the host kernel have facilities for normal user processes to do so?
So how exactly can you control multiple isolated address spaces for the leaf user processes and how do you handle syscalls? Does the host kernel have facilities for normal user processes to do so?
From the README
> The current implementation includes a security-focused x86-64 interpreter and a balanced native ptrace backend;
ptrace allows you to have the kernel redirect syscalls back to userspace, mostly for debugging purposes. "balanced" here refers to speed, but the overhead is still quite high.