search
dm-thin
Trends
- 1Cloudflare Containers' disk isolation questioned over unzeroed thin-pool blocks●A microVM per tenant does not isolate the disk if the thin pool hands out recycled blocks unzeroed. Cloudflare Container
A discussion is underway about whether Cloudflare's Containers service, which gives each tenant a Firecracker microVM on dm-thin provisioning with block zeroing skipped, can truly isolate tenant disk data. Because the thin pool uses 64 KiB blocks and hands out recycled blocks unzeroed, a tenant writing 4 KiB could read neighboring data from a previous tenant in the remaining space.