A developer explores building a deterministic hypervisor for running Linux kernels, discussing the core challenges of concurrency and hardware nondeterminism. The post examines existing approaches like Antithesis's use of Intel performance counters and traditional emulator-based solutions from cybersecurity fuzzing, while hinting at alternative implementation strategies.
Google is developing Orphaned VMs, a technology that allows virtual machines to continue running uninterrupted on preserved physical CPUs while the host Linux kernel undergoes live updates through the Live Update Orchestrator. The RFC patches, currently at 46 patches and led by Pasha Tatashin, introduce infrastructure for vCPU state preservation and a Caretaker bare-metal layer to handle VM operations during host reboots, though the work remains early-stage and not yet production-ready.
Docker patched a sandbox escape vulnerability (CVE-2026-77179) in its hypervisor for Mac that allowed containers to read and write the host filesystem using a symlink-based attack. The flaw affected Docker Desktop with VMM enabled and Docker Sandboxes, and has been fixed in Docker Desktop 4.88.0 and Docker Sandboxes 0.42.0.
Docker patched a critical sandbox escape vulnerability (CVE-2026-77179) in its hypervisor for Mac that allowed containers to read and write the host filesystem using a three-line bash exploit involving virtio-fs path manipulation. The flaw affected Docker Desktop with Docker VMM enabled and Docker Sandboxes, with fixes released in Docker Desktop 4.88.0 and Docker Sandboxes 0.42.0.