I used to have paying customers on UML on a Red Hat 7.3 box. I had no idea that UML had been maintained as recently as 2.6.24. I really had no reason to follow it, because UML's niche has been eaten away from both top and bottom.
The bottom: For super-high-density virtual private servers, it makes more sense to use OpenVZ (http://www.openvz.org) and its commercial counterpart, Virtuozzo (http://www.parallels.com). I've seen installations with 300-500 VMs running on a system with 2G of RAM. It's not a great user experience, but it sure is ... dense. This is where those $5/month VPSes came from.
The top: For more conventional virtualization needs, there's Xen and KVM. More flexible, less of a pain in the system administrator's ass. This is the route Slicehost and Linode took.
What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.
Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.
I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.
You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.
If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.
There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.
Comments
I used to have paying customers on UML on a Red Hat 7.3 box. I had no idea that UML had been maintained as recently as 2.6.24. I really had no reason to follow it, because UML's niche has been eaten away from both top and bottom.
The bottom: For super-high-density virtual private servers, it makes more sense to use OpenVZ (http://www.openvz.org) and its commercial counterpart, Virtuozzo (http://www.parallels.com). I've seen installations with 300-500 VMs running on a system with 2G of RAM. It's not a great user experience, but it sure is ... dense. This is where those $5/month VPSes came from.
The top: For more conventional virtualization needs, there's Xen and KVM. More flexible, less of a pain in the system administrator's ass. This is the route Slicehost and Linode took.
What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.
Use Linux containers (lxc). Exactly what you need...
Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.
I'll have a dig into that next then - thanks! :-)
I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful.
You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies.
If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.
There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.
Just an FYI, Linode used to have UML "back in the day."
There was an interesting quote about a year ago from the CEO of Linode regarding uncertainty of staying with Xen and instead moving on to KVM.
http://searchservervirtualization.techtarget.com/news/151637...
That's not an uncommon experience: http://blog.bytemark.co.uk//2011/02/28/why-we-skipped-xen