Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Are there any notable differences between LXC (Linux containers) and FreeBSD's jails in terms of security, stability & performance?

On first look, both approaches look very similar.

share|improve this question
    
LXC is a rather new technology, so I would expect better security and stability with jails. Not even a guess about performance. There are some known security issues with LXC that can be mitigated using selinux, for example. I personally like LXC, though. –  Pavel Šimerda Apr 28 at 23:30
    
@PavelŠimerda I just heard of LXC today, but I was suprised to find outh that both Heroku and probably Google App Engine already use LXC. –  Philipp Claßen Apr 29 at 0:01
1  
If you've just bumped into LXC you should take a look at Docker which uses LXC under the bonnet: docker.io/the_whole_story –  Kev Apr 29 at 0:54

1 Answer 1

up vote 6 down vote accepted

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steriods" are names or commercial titles that defines the same concept of userspace separation, but with different features.

Chroot was introduced on 18 March 1982, months before the release of 4.2BSD as a tool to test installation and build system, but for today it still have its flaws. Since the first objective of chroot was only to provide a newroot path, other aspects of system that needed to be isolated or controled got uncovered(network, process view, I/O throughput). This is where the first containers(User-level virtualization) appeared.

Both technologies(FreeBSD Jails and LXC) makes use of userspace isolation to provide another layer of security. This compartmentalisation will ensure that a determined process will communicate only with other processes on the same container at the same host, and if using any network resource to achieve "outside world" communication, all will be forwarded to the assigned interface/channel that this container have.

Features

FreeBSD Jails:

  • Considered stable technology, since it is a feature inside FreeBSD since 4.0;
  • It takes the best of ZFS filesystem at the point where you could clone jails and create jail templates to easily deploy more jails. Some more ZFS madness;
  • Well documented, and evolving;
  • Hierarchical Jails allow you to create jails inside a jail(we need to go deeper!). Combine with allow.mount.zfs to achieve more power, and other variables like children.max do define max children jails.;
  • rctl(8) will handle resource limits of jails(memory, cpu, disk, ...)
  • FreeBSD jails handle linux userspace;
  • Network isolation with vnet, allowing each jail to have it´s own network stack, interfaces, addressing and routing tables.
  • nullfs to help linking folders to ones that are located on the real server to inside a jail

Linux Containers(LXC):

  • New "in kernel" technology but being endorsed by big ones;
  • Unprivileged containers starting from LXC 1.0, makes a big step into security inside containers;
  • UID and GID mapping inside containers;
  • Kernel namespaces, to make separation of ipc, mount, pid, network and users. These namespaces can be handled in a detached way, where a process that uses a different network namespace not necessarily will be isolated on other aspects like storage;
  • Control Groups(cgroups) to manage resources and grouping them;
  • Extensible API like Docker, to deploy already

Both technologies are not security panaceas, but are pretty good ways to isolate an environment that dont require Full Virtualization due to mixed operating systems infrastructure. Security will come after a lot of documentation reading and implementation of kernel tunnables, MAC and isolations that those OS-Level virt offer to you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.