2

Every time I need to create VPSs out of one of our machines, I (re)think the virtualization technologies, and seem to end up with OpenVZ being the most suitable for performance reasons when all I want is clean separation between VPSs. All running GNU/Linux.

The question I have is, for a scenario with the following facts, when is it ever more advisable to go for Xen? Here goes the situational facts:

  • I trust everyone who will be using the VPSs, the issue of virtualization security is not a concern
  • The host and guests will all be running GNU/Linux
  • Me and my team manage all the VPSs ourselves

Normally I would be comfortable with my decision to go with OpenVZ, but I keep reading about reputable engineers using Xen in scenarios that I imagine are very similar to mine, Github being one example.

Amr Mostafa
  • 353
  • 2
  • 6
  • I think about virtualization technology, but I have _never_ found OpenVZ to be suitable for anything. – Michael Hampton Sep 08 '13 at 12:57
  • I'd probably be using [Linux LXC containers](http://lxc.sourceforge.net) for this application. Xen would never come to mind for this. – ewwhite Sep 08 '13 at 15:00

2 Answers2

2

OpenVZ containers have very low overhead and are easy to manage from the host. However, the main drawbacks of OpenVZ are fault tolerance and flexibility.

Code running inside an OpenVZ container could trigger a kernel panic that crashes the entire node. If you allow containers to act as NFS clients, an NFS hang could stall the whole system.

OpenVZ containers have to run the same kernel version as the host. They cannot insert kernel modules. Furthermore, they can only use Linux features that have been OpenVZ-virtualized, so you can't use autofs, for example (as of 2013).

If you know that you can live with these limitations, then by all means try OpenVZ. If it doesn't work out, it's not that difficult to switch to a full virtualization solution. (The outline of the process is: create a disk image, loopback-mount it, install a kernel, re-enable some inittab entries.)

200_success
  • 4,771
  • 1
  • 25
  • 42
  • I didn't know that code running in user-land could trigger a kernel panic. Is that really possible? – Amr Mostafa Sep 09 '13 at 10:52
  • @AmrMostafa It's not supposed to be possible, but kernel bugs happen, and system administrators have to take that possibility into account like any other eventuality. – 200_success Sep 09 '13 at 11:10
1

You may trust the people who will be administering and using the VPSs, but can you trust the software? If a guest system panics, it may crash the entire node. If a guest system is vulnerable, then the entire node is at risk.

Of course, any hypervisor is also a piece of software, thus susceptible to bugs and vulnerabilities, but with smaller attack surface and stronger isolation than a container technology.

Anton Samsonov
  • 281
  • 1
  • 9