Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to decide between "jailing" certain applications and I know the trade-offs of KVM versus LXC and how I can use them both.

Lately I came across UML (User-Mode Linux) again and was wondering how it compares with respect to security and resource consumption (or overhead, if you will).

Where can I find a comparison like that, or does anyone here know how they compare?

Basically:

  • what is the disk I/O and CPU overhead?
  • how strict is the separation and how secure is the host from what's going on in the guest?
share|improve this question
    
UML's separation is that it runs the kernel as an ordinary, non-privileged process on the host. –  derobert Sep 10 '13 at 16:37
    
Virtualization is going to be more secure and more demanding on your hardware in practically every situation. UML doesn't need to worry about emulating anything; it simply runs another instance of the kernel for each user which is much more lightweight than running a machine emulator to emulate an entire OS. Because LXC is only emulating the OS it doesn't do the machine emulation but it does have higher overhead; as their own website puts it they are “chroot on steroids”. –  krowe Sep 10 '13 at 17:36
    
BTW, I didn't mention this but LXC is probably going to be the best option because UML is not very well isolated and in the past many exploits have been used which use that fact to their advantage. Also, the performance difference is negligible since no hardware is being emulated. –  krowe Sep 10 '13 at 17:39

1 Answer 1

up vote 3 down vote accepted
  • Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower.
  • Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML.
  • Strict separation and security: UML > KVM > LXC. Contrary to the statements above by krowe, if you want security above all else, UML is the way to go. You can run the UML kernel process as a totally unprivileged user, in a restricted chrooted environment, with any hardening you want on top. Escaping from the VM would require finding a kernel bug first, and even then, at best you end up with the privileges of a normal user process on the host. Now, if you care about performance... KVM is a much better option. LXC will give you the best performance, but is also the least secure of the 3.
share|improve this answer
1  
There is also usermode LXC. Whith it you can arguably get a pretty good security too, roughly comparable to KVM or even better. UML still is more secure, since it should be more immune to privilege escalation via kernel bugs. –  Adam Ryczkowski Dec 11 at 7:15
1  
@AdamRyczkowski: that is a misunderstanding. LXC always relies on kernel functionality. There is no pure user mode or kernel mode LXC. What you mean, though, are unprivileged LCX containers. And yes, they exist and are based on userns (user name spaces) and thereby allow a container to run mostly (e.g. creation of network devices for the guest on the host requires a privileged operation) unprivileged. Assuming there are unknown issues in the kernel, your final assessment is probably right, though. –  0xC0000022L Dec 12 at 9:44
    
@0xC0000022L This is exactly what I mean. –  Adam Ryczkowski Dec 12 at 12:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.