But I guess they are good enough to isolate multiple instances of the same code, ran by the same customer in parallel.
replyWithout commenting on v8 isolates specifically, this doesn't necessarily hold in any isolation situation; many customers are running code on behalf of their customers, which are often submitting jobs on behalf of theirs, and so on. Isolation breaches within a platform customer can result in significant cross-user data breaches.
replyWhy are v8 isolates bad, I see speculative execution hacks, but are there others?
replyDespite naming them isolates, the V8 team does not consider them to be a security boundary.
replyThe v8 JIT is very complex and can lead to sandbox escapes if there are type confusion bugs.
replyv8 isolates are still shared kernel
replywhile microvm's are separate kernel + hardware virtualization through hypervisor guarantees
I wouldn't call it bad either, just different tools for different things
Not only are they shared kernel... They're shared process, shared address space, shared memory pool and allocator... In fact, there is very little isolated about them at all.
replyI bet there are a million ways to cause side channels allowing learning about other code or data on the same machine, and just one V8 bug (of which there have historically been thousands) let's you take over or modify code in another isolate.