Differences between LXC, KVM and Firejail

Question

Also, what is the closest thing to FreeBSD jails in GNU/Linux?

Answer 1

Here's a very brief attempt to summarise the differences between the three tools you mentioned, KVM, LXC, and Firejail. It glosses over a lot of detail, and is not intended to be scrupulously accurate, just give a general impression. For more details, you'll have to do some research - start by reading the web sites for the software (linked below), and then search on google (and Wikipedia) for extra info as required.

Wikipedia is particularly useful for providing summaries of technologies and links to comparison tables of similar software.

• KVM stands for "Kernel Virtual Machine" and provides a hypervisor for complete virtualisation, i.e. emulation of hardware, allowing for the installation and simultaneous execution of multiple guest operating systems on the same hardware.

  Each VM sees a completely different set of emulated hardware (including hard disks, network cards, console or graphics, etc), and can run its own kernel. KVM also allows hardware pass-through of particular devices to specific VMs, so they have exclusive access to that hardware (e.g. a second GPU, or a specific NIC).

  You'd use this if you wanted to, for example, run Linux and Windows and FreeBSD and a Hackintosh on the same machine at the same time.

  It is similar to VirtualBox or VMWare.

  See also KVM on Wikipedia.

• LXC is a containerisation system which uses kernel control groups and namespaces (for PIDs, networking, filesystems, etc) to provide reasonably strong isolation between processes. Unlike a VM, containers all run on the same host kernel, although they typically have their own (usually minimalist) userland to provide their own isolated /etc, /bin, /sbin, and so on. Different containers only have access to host resources that they're allowed to see.

  It's mostly used to run system or network services (such as apache or squid or bind) with greater isolation from the host system's resources and processes than is achievable just by using different UIDs and GIDs and fs permissions.

  In concept, containers are very similar to FreeBSD jails. And docker. Systemd also provides tools (systemd-nspawn and machinectl) to use and manage control groups and namespaces.

  See also LXC on Wikipedia.

• I haven't used Firejail, but it looks like it's another containerisation tool, this time with an emphasis on use by end-users rather than systems administrators (although that does not seem to be a hard limitation, just what the developers are focused on).

  e.g. it seems to allow for very easy isolation of user processes like web browsers or torrent clients, so that compromises of such internet-facing applications are far harder to escalate into a compromise of the user's files, or of the host OS itself.