"Faster than virtualization, but harder to implement, containers are a promising security technology for Linux. Watch the 2.6.24 kernel for experimental support for creating and managing containers."
To read all comments associated with this story, please click here.
Member since:2005-12-15
Member since:2005-11-05
This isn't quite solaris zones. This is the groundwork to allow for things like zones. The OpenVZ guys have been very slowly trying to get their code in the upstream kernel. As a result, they rework or generify their code so it works for everything.
It might be another kernel or two before you see full "Solaris Zone" functionality in the Linux kernel. This is a very solid start.
Member since:2005-07-08
Yes, the goal for this work is an OS-level virtualization solution similar to Zones and OpenVZ/Virtuozzo. The namespaces referred to in the article aren't per-process as with Plan9 but rather per-container. Or per-subsystem, per-container.
In any case, Linux has had per-process namespace capabilities since the 2.5.x series, courtesy of Al Viro. Kernel developers think they're cool, but userspace developers haven't really done anything with them. Union mounts (mounting multiple filesystems at the same mount point) seem more useful, and I believe the work there is still ongoing. The Glick application bundle solution uses a really neat FUSE trick to create process-private filesystems in userspace.
The container solution seems to be coming along nicely and on schedule. This is the sort of thing that shouldn't be rushed. It's easy for stuff like this to make a horrible mess of the kernel that developers will be stuck with for years. That's why it's important for out-of-tree projects like OpenVZ to make a mess of things so that we can step back, generate some lessons-learned, and figure out how to do this nicely. In the meantime, we already have a commercially-viable OS-virtualization solution that tracks the mainline fairly closely.
Member since:
2007-09-27
so this sounds like solaris zones, or maybe BSD jails. I may be wrong though. All of these things kinda remind me of plan9's namespace separation, and makes me wonder if it would have made a lot of lives easier.