[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Which virtualization is the best for Debian?



Sthu Deus wrote:
Thank You for Your time and answer, randall:

thanks to the fact it shares the same kernel with the host and all the guests, but this could be a disadvantage if you need a seperate kernel per guest.

One of the reasons I would like to use virtualization is security... so, how does using of a single kernel affect total security/separation - at my view - it does not help in this view. Though I do not know how openvz or xen work...
i'm not an expert but i will explain a little what i think i know.

xen and vmware can give you the best seperation/security because each guest will run its own kernel, this will affect the performance however since you are simply running several complete operating systems ( you could run linux in 1 guest, windows in another and FreeBSd in yet another etc... )

VServer and i guess also openvz are simply a very smart way of using chroot to isolate several services just like the jails utility in FreeBSD, this off course has the advantage that there is no performance overhead , VServer is set up by default not to allow the guest direct access to the kernel but for some programs, like bind, you have to loosen up the privileges to the kernel a little so this brings a little risk although most programs will run without any modification needed.

also, with xen and vmware you can run a firewall inside each guest itself as well which you can not do with VServer since this needs kernel access, with VServer i have the firewall on the host system allowing/blocking traffic to the guests.


Openvz basically is somewhere in the same league as VServer, i started with VServer and it did what i wanted + a active and extremely helpfull mailinglist so i never looked back

Did You compile Your own kernels for Debian? - And then ever after - on update?
some do, but i always use the vserver patched kernel from the repos, it never gave me any problems and i'm always assured of the security updates, did not have any issue when upgrading from etch to lenny.

The thing you heard was broken is the vserver-debiantools package which apparently is in a bad state for years already ( have used these in the past and still do, but i never experienced a problem myself ). But you simply do not need this package, just follow the directions on the VServer wiki





Reply to: