Virtualization isn't the only way to isolate apps. What happened to good old Unix user accounts? It seems ridiculous to me to allocate entire kernels and OS runtimes per user/app when they can just share all that stuff and have the kernel isolate access and divide resources.
Because since then code has got more hostile. Arbitrary code execution attacks and then local root exploits are not uncommon. You have to make some effort to protect against these. Lxc as mentioned at least isolates processes, file system and network access which helps a lot.
I've used linux-vserver.org years ago and lxc, which is in the official kernel, looks promising. This would be relativly efficient and secure (ok, one kernel exploit => all instances)
Comments
Virtualization isn't the only way to isolate apps. What happened to good old Unix user accounts? It seems ridiculous to me to allocate entire kernels and OS runtimes per user/app when they can just share all that stuff and have the kernel isolate access and divide resources.
Because since then code has got more hostile. Arbitrary code execution attacks and then local root exploits are not uncommon. You have to make some effort to protect against these. Lxc as mentioned at least isolates processes, file system and network access which helps a lot.
I've used linux-vserver.org years ago and lxc, which is in the official kernel, looks promising. This would be relativly efficient and secure (ok, one kernel exploit => all instances)