EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 24·5 min read
Show HN: Kern – container and resource runtime in a 1.5 MB binary, no daemon
TL;DR
Kern is a lightweight, rootless container and resource runtime that operates from a 1.52 MB binary without a daemon, achieving kernel-enforced isolation in approximately 3.5 milliseconds. It is designed to handle any workload, including untrusted and AI-generated code.
✦ Why It Matters
Consider using Kern for lightweight, secure containerization in your next project involving untrusted code.
Key Takeaways
- Install Kern using a single static binary for quick setup.
- Utilize Kern's resource profiles to manage CPU and memory limits.
- Run untrusted code safely with the --security-profile untrusted flag.
- Leverage Kern's compatibility with existing Docker Compose files.
How It Works
Kern operates by leveraging Linux kernel features such as user namespaces and cgroups to provide isolation and resource management. It starts containers in a matter of milliseconds by directly invoking the kernel without the overhead of a daemon.
Users can define resource limits in a configuration file, which Kern applies to processes, ensuring efficient resource utilization while maintaining security.