Msg03136.html
From Linix VServer
Jump to navigationJump to search
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[vserver] Re: security comparison between vserver and UML[edit]
- From: John Goerzen
- Date: Fri, 9 May 2003 16:44:05 +0100 (BST)
"Mitchell Smith" <mjs@xxxxxxxxxxxxxxxxxxx> writes: > In a production environment does UML http://user-mode-linux.sourceforge.net > offer any security advantages over vserver? The isolation is somewhat more complete, but generally it protects you only against administrative errors. For instance, some people setting up a vserver may leave /dev/hda nodes in /dev. If you set up the vserver without those, it'll be secure since it prevents people from doing that themselves. A few applications require relaxed permissions in a vserver and may not require those in UML. The disadvantages of UML exist, too, which is why we're using vserver instead of UML on our production server. A big one is performance. Since applications running in a vserver are running as close "to the metal" as any other application, they're not any slower. UML adds an extra layer of emulation, which hurts performance. I have seen *significant* (we're talking 10x-30x) performance hits with multithreaded apps running under UML. Another is the filesystem. vservers can have directories on your regular filesystem. For instance, we have a 130GB ext3 filesystem that all our vservers run off. It's a lot easier to manage space that way, and wastes less space (you don't have to allocate extra space to a vserver to start with, or adjust these things later) I've found UML networking to be unreliable and fairly slow as well. > The other advantage I see over UML, is you would be able to enforce per user > system resource limits, amount of memory etc, where as you probably couldn't > do that with vserver, or no way that I have found yet. ulimit works in a vserver. You can also set hard limits for the entire server; see the ULIMIT option in the config file and "man ulimit". > Any suggestions on the advantages of one system over the other greatly > appreciated. I'd say the net result is that UML theoretically has a higher amount of isolation, but in practical terms, vserver achieves similar results without so many problems. -- John
- References:
- [vserver] security comparison between vserver and UML
- From: Mitchell Smith
- [vserver] security comparison between vserver and UML
- Prev by Date: [vserver] Re: VServer production usage
- Next by Date: [vserver] root server as firewall and virtual servers for public services - a save approach ?
- Previous by thread: Re: [vserver] security comparison between vserver and UML
- Next by thread: [vserver] interesting side effect
- Index(es):