Post #3484196

2026-06-17 12:46 UTC

I was going to build my system like that, but recently learned that host client isolation is not as strong as people make you believe. just a few weeks ago we learned that copy fail (security vulnerability) was on major distros for years until it was fixed, it would allow containers and VMS to infect the host system. Xz utils could also lead to a broken host client separation, as proxmox uses ssh for clustering and the like. So for really important stuff I am going to have a dedicated physical server or put it in cold storage altogether. That said, I am by no means an expert so feel free to correct me if I got something wrong.

Replies (1)

@hirihit640@sh.itjust.works 2026-06-17 13:29

copy fail allows VMs to infect the host system? I thought it was a kernel vulnerability, not a hypervisor vulnerability. Containers and LXCs share the kernel with the host, full VMs do not. So a kernel exploit allows container escape but not VM escape. Kernel exploits happen a few times a year. Hypervisor exploits and VM escapes are VERY rare. Using SSH for clustering is optional. You can just use normal VMs. You don’t have to install SSH into the VM, you can view it through proxmox. The only difference between a VM and a separate physical machine is the hypervisor, so the only security difference is the security of the hypervisor. And as I mentioned, hypervisor exploits are very rare. Edit: for a sense of perspective, think about this. Almost every major tech company in the world relies on hypervisors for security. Qubes OS, known in the privacy/security world as one of if not the most secure OSes, relies on the hypervisor for security. An easily exploitable hypervisor escape would be a vulnerability on the scale of the XZ utils backdoor (which was unsuccessful). I have not seen a vulnerability of that scale since heartbleed. Edit2: a word

Open ##3484195