8

I'm trying to decide between "jailing" certain applications and I know the trade-offs of KVM versus LXC and how I can use them both.

Lately I came across UML (User-Mode Linux) again and was wondering how it compares with respect to security and resource consumption (or overhead, if you will).

Where can I find a comparison like that, or does anyone here know how they compare?

Basically:

  • what is the disk I/O and CPU overhead?
  • how strict is the separation and how secure is the host from what's going on in the guest?
Improve this question
3
  • UML's separation is that it runs the kernel as an ordinary, non-privileged process on the host.
    – derobert
    Commented Sep 10, 2013 at 16:37
  • Virtualization is going to be more secure and more demanding on your hardware in practically every situation. UML doesn't need to worry about emulating anything; it simply runs another instance of the kernel for each user which is much more lightweight than running a machine emulator to emulate an entire OS. Because LXC is only emulating the OS it doesn't do the machine emulation but it does have higher overhead; as their own website puts it they are “chroot on steroids”.
    – krowe
    Commented Sep 10, 2013 at 17:36
  • BTW, I didn't mention this but LXC is probably going to be the best option because UML is not very well isolated and in the past many exploits have been used which use that fact to their advantage. Also, the performance difference is negligible since no hardware is being emulated.
    – krowe
    Commented Sep 10, 2013 at 17:39

1 Answer 1

Reset to default
10
  • Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower.
  • Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML.
  • Strict separation and security: UML > KVM > LXC. Contrary to the statements above by krowe, if you want security above all else, UML is the way to go. You can run the UML kernel process as a totally unprivileged user, in a restricted chrooted environment, with any hardening you want on top. Escaping from the VM would require finding a kernel bug first, and even then, at best you end up with the privileges of a normal user process on the host. Now, if you care about performance... KVM is a much better option. LXC will give you the best performance, but is also the least secure of the 3.
Improve this answer
6
  • 1
    There is also usermode LXC. Whith it you can arguably get a pretty good security too, roughly comparable to KVM or even better. UML still is more secure, since it should be more immune to privilege escalation via kernel bugs.
    – Adam Ryczkowski
    Commented Dec 11, 2014 at 7:15
  • 2
    @AdamRyczkowski: that is a misunderstanding. LXC always relies on kernel functionality. There is no pure user mode or kernel mode LXC. What you mean, though, are unprivileged LCX containers. And yes, they exist and are based on userns (user name spaces) and thereby allow a container to run mostly (e.g. creation of network devices for the guest on the host requires a privileged operation) unprivileged. Assuming there are unknown issues in the kernel, your final assessment is probably right, though.
    – 0xC0000022L
    Commented Dec 12, 2014 at 9:44
  • @0xC0000022L This is exactly what I mean.
    – Adam Ryczkowski
    Commented Dec 12, 2014 at 12:22
  • @totaam: your discussion about the security of UML implies that a userns LXC guest would be equally secure as a UML one, which contradicts the statement that LXC is least secure.
    – 0xC0000022L
    Commented May 15, 2015 at 9:49
  • @0C0000022L: No, not even close. userns shares the same kernel.
    – totaam
    Commented Jun 18, 2015 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .