I'm trying to decide between "jailing" certain applications and I know the trade-offs of KVM versus LXC and how I can use them both.

Lately I came across UML (User-Mode Linux) again and was wondering how it compares with respect to security and resource consumption (or overhead, if you will).

Where can I find a comparison like that, or does anyone here know how they compare?


  • what is the disk I/O and CPU overhead?
  • how strict is the separation and how secure is the host from what's going on in the guest?
  • UML's separation is that it runs the kernel as an ordinary, non-privileged process on the host. – derobert Sep 10 '13 at 16:37
  • Virtualization is going to be more secure and more demanding on your hardware in practically every situation. UML doesn't need to worry about emulating anything; it simply runs another instance of the kernel for each user which is much more lightweight than running a machine emulator to emulate an entire OS. Because LXC is only emulating the OS it doesn't do the machine emulation but it does have higher overhead; as their own website puts it they are “chroot on steroids”. – krowe Sep 10 '13 at 17:36
  • BTW, I didn't mention this but LXC is probably going to be the best option because UML is not very well isolated and in the past many exploits have been used which use that fact to their advantage. Also, the performance difference is negligible since no hardware is being emulated. – krowe Sep 10 '13 at 17:39
  • Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower.
  • Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML.
  • Strict separation and security: UML > KVM > LXC. Contrary to the statements above by krowe, if you want security above all else, UML is the way to go. You can run the UML kernel process as a totally unprivileged user, in a restricted chrooted environment, with any hardening you want on top. Escaping from the VM would require finding a kernel bug first, and even then, at best you end up with the privileges of a normal user process on the host. Now, if you care about performance... KVM is a much better option. LXC will give you the best performance, but is also the least secure of the 3.
  • 1
    There is also usermode LXC. Whith it you can arguably get a pretty good security too, roughly comparable to KVM or even better. UML still is more secure, since it should be more immune to privilege escalation via kernel bugs. – Adam Ryczkowski Dec 11 '14 at 7:15
  • 2
    @AdamRyczkowski: that is a misunderstanding. LXC always relies on kernel functionality. There is no pure user mode or kernel mode LXC. What you mean, though, are unprivileged LCX containers. And yes, they exist and are based on userns (user name spaces) and thereby allow a container to run mostly (e.g. creation of network devices for the guest on the host requires a privileged operation) unprivileged. Assuming there are unknown issues in the kernel, your final assessment is probably right, though. – 0xC0000022L Dec 12 '14 at 9:44
  • @0xC0000022L This is exactly what I mean. – Adam Ryczkowski Dec 12 '14 at 12:22
  • @totaam: your discussion about the security of UML implies that a userns LXC guest would be equally secure as a UML one, which contradicts the statement that LXC is least secure. – 0xC0000022L May 15 '15 at 9:49
  • @0C0000022L: No, not even close. userns shares the same kernel. – totaam Jun 18 '15 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.