Operating-system-level virtualization

From HandWiki

Operating-system-level virtualization, also known as containerization, refers to an operating system feature in which the kernel allows the existence of multiple isolated user-space instances. Such instances, called containers,[1] partitions, virtual environments (VEs) or jails (FreeBSD jail or chroot jail), may look like real computers from the point of view of programs running in them. A computer program running on an ordinary operating system can see all resources (connected devices, files and folders, network shares, CPU power, quantifiable hardware capabilities) of that computer. However, programs running inside a container can only see the container's contents and devices assigned to the container.

On Unix-like operating systems, this feature can be seen as an advanced implementation of the standard chroot mechanism, which changes the apparent root folder for the current running process and its children. In addition to isolation mechanisms, the kernel often provides resource-management features to limit the impact of one container's activities on other containers.

System-level-virtualization is frequently implemented in remote access applications with dynamic cloud access, allowing for simultaneous two-way data streaming over closed networks.[2]

Operation

On ordinary operating systems for personal computers, a computer program can see (even though it might not be able to access) all the system's resources. They include:

  1. Hardware capabilities that can be employed, such as the CPU and the network connection
  2. Data that can be read or written, such as files, folders and network shares
  3. Connected peripherals it can interact with, such as webcam, printer, scanner, or fax

The operating system may be able to allow or deny access to such resources based on which program requests them and the user account in the context of which it runs. The operating system may also hide those resources, so that when the computer program enumerates them, they do not appear in the enumeration results. Nevertheless, from a programming point of view, the computer program has interacted with those resources and the operating system has managed an act of interaction.

With operating-system-virtualization, or containerization, it is possible to run programs within containers, to which only parts of these resources are allocated. A program expecting to see the whole computer, once run inside a container, can only see the allocated resources and believes them to be all that is available. Several containers can be created on each operating system, to each of which a subset of the computer's resources is allocated. Each container may contain any number of computer programs. These programs may run concurrently or separately, even interact with each other.

Containerization has similarities to application virtualization: In the latter, only one computer program is placed in an isolated container and the isolation applies to file system only.

Uses

Operating-system-level virtualization is commonly used in virtual hosting environments, where it is useful for securely allocating finite hardware resources among a large number of mutually-distrusting users. System administrators may also use it for consolidating server hardware by moving services on separate hosts into containers on the one server.

Other typical scenarios include separating several programs to separate containers for improved security, hardware independence, and added resource management features. The improved security provided by the use of a chroot mechanism, however, is nowhere near ironclad.[citation needed] Operating-system-level virtualization implementations capable of live migration can also be used for dynamic load balancing of containers between nodes in a cluster.

Overhead

Operating-system-level virtualization usually imposes less overhead than full virtualization because programs in virtual partitions use the operating system's normal system call interface and do not need to be subjected to emulation or be run in an intermediate virtual machine, as is the case with full virtualization (such as VMware ESXi, QEMU or Hyper-V) and paravirtualization (such as Xen or UML). This form of virtualization also does not require hardware support in for efficient performance.

Flexibility

Operating-system-level virtualization is not as flexible as other virtualization approaches since it cannot host a guest operating system different from the host one, or a different guest kernel. For example, with Linux, different distributions are fine, but other operating systems such as Windows cannot be hosted.

Solaris partially overcomes the limitation described above with its branded zones feature, which provides the ability to run an environment within a container that emulates an older Solaris 8 or 9 version in a Solaris 10 host. Linux branded zones (referred to as "lx" branded zones) are also available on x86-based Solaris systems, providing a complete Linux userspace and support for the execution of Linux applications; additionally, Solaris provides utilities needed to install Red Hat Enterprise Linux 3.x or CentOS 3.x Linux distributions inside "lx" zones.[3][4] However, in 2010 Linux branded zones were removed from Solaris; in 2014 they were reintroduced in Illumos, which is the open source Solaris fork, supporting 32-bit Linux kernels.[5]

Storage

Some operating-system-level virtualization implementations provide file-level copy-on-write (CoW) mechanisms. (Most commonly, a standard file system is shared between partitions, and those partitions that change the files automatically create their own copies.) This is easier to back up, more space-efficient and simpler to cache than the block-level copy-on-write schemes common on whole-system virtualizers. Whole-system virtualizers, however, can work with non-native file systems and create and roll back snapshots of the entire system state.

Implementations

Mechanism Operating system License Available since or between Features
File system isolation Copy on Write Disk quotas I/O rate limiting Memory limits CPU quotas Network isolation Nested virtualization Partition checkpointing and live migration Root privilege isolation
chroot Most UNIX-like operating systems Varies by operating system 1982 Partial[lower-alpha 1] No No No No No No Yes No No
Docker Linux,[7] FreeBSD,[8] Windows x64 (Pro, Enterprise and Education)[9] macOS [10] Apache License 2.0 2013 Yes Yes Not directly Yes (since 1.10) Yes Yes Yes Yes Only in Experimental Mode with CRIU [1] Yes (since 1.10)
Linux-VServer
(security context) 		Linux, Windows Server 2016 GNU GPLv2 2001 Yes Yes Yes Yes[lower-alpha 2] Yes Yes Partial[lower-alpha 3] ? No Partial[lower-alpha 4]
lmctfy Linux Apache License 2.0 2013 Yes Yes Yes Yes[lower-alpha 2] Yes Yes Partial[lower-alpha 3] ? No Partial[lower-alpha 4]
LXC Linux GNU GPLv2 2008 Yes[12] Yes Partial[lower-alpha 5] Partial[lower-alpha 6] Yes Yes Yes Yes No Yes[12]
Singularity Linux BSD Licence 2015[13] Yes[14] Yes Yes No No No No No No Yes[15]
OpenVZ Linux GNU GPLv2 2005 Yes Yes (ZFS) Yes Yes[lower-alpha 7] Yes Yes Yes[lower-alpha 8] Partial[lower-alpha 9] Yes Yes[lower-alpha 10]
Virtuozzo Linux, Windows Trialware 2000[19] Yes Yes Yes Yes[lower-alpha 11] Yes Yes Yes[lower-alpha 8] Partial[lower-alpha 12] Yes Yes
Solaris Containers (Zones) illumos (OpenSolaris),
Solaris 		CDDL,
Proprietary 		2004 Yes Yes (ZFS) Yes Partial[lower-alpha 13] Yes Yes Yes[lower-alpha 14][22][23] Partial[lower-alpha 15] Partial[lower-alpha 16][lower-alpha 17] Yes[lower-alpha 18]
FreeBSD jail FreeBSD, DragonFly BSD BSD License 2000[25] Yes Yes (ZFS) Yes[lower-alpha 19] Yes Yes[26] Yes Yes[27] Yes Partial[28][29] Yes[30]
sysjail OpenBSD, NetBSD BSD License 2006–2009 Yes No No No No No Yes No No ?
WPARs AIX Commercial proprietary software 2007 Yes No Yes Yes Yes Yes Yes[lower-alpha 20] No Yes[32] ?
iCore Virtual Accounts Windows XP Freeware 2008 Yes No Yes No No No No ? No ?
Sandboxie Windows Trialware 2004 Yes Yes Partial No No No Partial No No Yes
systemd-nspawn Linux GNU LGPLv2.1+ 2010 Yes Yes Yes[33][34] Yes[33][34] Yes[33][34] Yes[33][34] Yes ? ? Yes
Turbo Windows Freemium 2012 Yes No No No No No Yes No No Yes
RKT Linux Apache License 2.0 ? ? ? ? ? ? ? ? ? ? ?

Cloud computing and Container Registry services

Several companies offer container hosting and container image registry services:

See also

Notes

  1. ↑ Root user can easily escape from chroot. Chroot was never supposed to be used as a security mechanism.[6]
  2. ↑ 2.0 2.1 Utilizing the CFQ scheduler, there is a separate queue per guest.
  3. ↑ 3.0 3.1 Networking is based on isolation, not virtualization.
  4. ↑ 4.0 4.1 A total of 14 user capabilities are considered safe within a container. The rest may cannot be granted to processes within that container without allowing that process to potentially interfere with things outside that container.[11]
  5. ↑ Disk quotas per container are possible when using separate partitions for each container with the help of LVM, or when the underlying host filesystem is btrfs, in which case btrfs subvolumes are automatically used.
  6. ↑ I/O rate limiting is supported when using Btrfs.
  7. ↑ Available since Linux kernel 2.6.18-028stable021. Implementation is based on CFQ disk I/O scheduler, but it is a two-level schema, so I/O priority is not per-process, but rather per-container.[16]
  8. ↑ 8.0 8.1 Each container can have its own IP addresses, firewall rules, routing tables and so on. Three different networking schemes are possible: route-based, bridge-based, and assigning a real network device (NIC) to a container.
  9. ↑ Docker containers can run inside OpenVZ containers.[17]
  10. ↑ Each container may have root access without possibly affecting other containers.[18]
  11. ↑ Available since version 4.0, January 2008.
  12. ↑ Docker containers can run inside Virtuozzo containers.[20]
  13. ↑ Yes with illumos[21]
  14. ↑ See OpenSolaris Network Virtualization and Resource Control for more details.
  15. ↑ Only when top level is a KVM zone (illumos) or a kz zone (Oracle).
  16. ↑ Starting in Solaris 11.3 Beta, Solaris Kernel Zones may use live migration.
  17. ↑ Cold migration (shutdown-move-restart) is implemented.
  18. ↑ Non-global zones are restricted so they may not affect other zones via a capability-limiting approach. The global zone may administer the non-global zones.[24]
  19. ↑ Check the "allow.quotas" option and the "Jails and File Systems" section on the FreeBSD jail man page for details.
  20. ↑ Available since TL 02.[31]

References

  1. ↑ Hogg, Scott (2014-05-26). "Software Containers: Used More Frequently than Most Realize". Network World, Inc. http://www.networkworld.com/article/2226996/cisco-subnet/software-containers--used-more-frequently-than-most-realize.html. "There are many other OS-level virtualization systems such as: Linux OpenVZ, Linux-VServer, FreeBSD Jails, AIX Workload Partitions (WPARs), HP-UX Containers (SRP), Solaris Containers, among others." 
  2. ↑ Portnoy, Matthew (2016). Virtualization Essentials. John Wiley & Sons. pp. 212-320. 
  3. ↑ "System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones, Chapter 16: Introduction to Solaris Zones". Oracle Corporation. 2010. http://docs.oracle.com/cd/E19044-01/sol.containers/817-1592/zones.intro-1/index.html. Retrieved 2014-09-02. 
  4. ↑ "System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones, Chapter 31: About Branded Zones and the Linux Branded Zone". Oracle Corporation. 2010. http://docs.oracle.com/cd/E19044-01/sol.containers/817-1592/gchhy/index.html. Retrieved 2014-09-02. 
  5. ↑ Bryan Cantrill (2014-09-28). "The dream is alive! Running Linux containers on an illumos kernel". http://www.slideshare.net/bcantrill/illumos-lx. Retrieved 2014-10-10. 
  6. ↑ "3.5. Limiting your program's environment". freebsd.org. http://www.freebsd.org/doc/en/books/developers-handbook/secure-chroot.html. 
  7. ↑ "Docker drops LXC as default execution environment". InfoQ. http://www.infoq.com/news/2014/03/docker_0_9. 
  8. ↑ "Docker comes to FreeBSD". https://www.freebsdnews.com/2015/07/09/docker-freebsd/. 
  9. ↑ "Get started with Docker for Windows". Docker. https://docs.docker.com/docker-for-windows/. 
  10. ↑ "Get started with Docker for Mac". https://docs.docker.com/docker-for-mac/. 
  11. ↑ Linux-VServer Paper, Secure Capabilities
  12. ↑ 12.0 12.1 Graber, Stéphane (1 January 2014). "LXC 1.0: Security features [6/10"]. https://www.stgraber.org/2014/01/01/lxc-1-0-security-features/. Retrieved 12 February 2014. "LXC now has support for user namespaces. [...] LXC is no longer running as root so even if an attacker manages to escape the container, he’d find himself having the privileges of a regular user on the host" 
  13. ↑ ""Sylabs brings Singularity containers into commercial HPC"". https://www.top500.org/news/sylabs-brings-singularity-containers-into-commercial-hpc/. 
  14. ↑ ""SIF — Containing Your Containers"". https://www.sylabs.io/2018/03/sif-containing-your-containers/. 
  15. ↑ ""Singularity: Scientific containers for mobility of compute"". http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0177459. 
  16. ↑ "I/O priorities for containers". OpenVZ Virtuozzo Containers Wiki. http://wiki.openvz.org/I/O_priorities_for_VE. 
  17. ↑ "Docker inside CT". https://openvz.org/Docker_inside_CT. 
  18. ↑ "Container". OpenVZ Virtuozzo Containers Wiki. http://wiki.openvz.org/Container. 
  19. ↑ "Initial public prerelease of Virtuozzo (named ASPcomplete at that time)". http://www.paul.sladen.org/vserver/aspcomplete/2000-08-25/ve-0.4.2-for-2.4.0-test6.diff.gz. 
  20. ↑ "Parallels Virtuozzo Now Provides Native Support for Docker". http://www.odin.com/news/pr/release/article/parallels-virtuozzo-now-provides-native-support-for-docker/. 
  21. ↑ Pijewski, Bill. "Our ZFS I/O Throttle". http://dtrace.org/blogs/wdp/2011/03/our-zfs-io-throttle/. 
  22. ↑ Network Virtualization and Resource Control (Crossbow) FAQ
  23. ↑ "Managing Network Virtualization and Network Resources in Oracle® Solaris 11.2". http://docs.oracle.com/cd/E36784_01/html/E36813/index.html. 
  24. ↑ Oracle Solaris 11.1 Administration, Oracle Solaris Zones, Oracle Solaris 10 Zones and Resource Management E29024.pdf, pp. 356–360. Available within an archive.
  25. ↑ "Contain your enthusiasm - Part Two: Jails, Zones, OpenVZ, and LXC". http://www.cybera.ca/news-and-events/tech-radar/contain-your-enthusiasm-part-two-jails-zones-openvz-and-lxc/. "Jails were first introduced in FreeBSD 4.0 in 2000" 
  26. ↑ "Hierarchical_Resource_Limits - FreeBSD Wiki". Wiki.freebsd.org. 2012-10-27. http://wiki.freebsd.org/Hierarchical_Resource_Limits. Retrieved 2014-01-15. 
  27. ↑ "Implementing a Clonable Network Stack in the FreeBSD Kernel". usenix.org. 2003-06-13. http://static.usenix.org/publications/library/proceedings/usenix03/tech/freenix03/full_papers/zec/zec.pdf. 
  28. ↑ "VPS for FreeBSD". http://www.7he.at/freebsd/vps/. Retrieved 2016-02-20. 
  29. ↑ "[Announcement VPS // OS Virtualization // alpha release"]. https://forums.freebsd.org/threads/34284/. Retrieved 2016-02-20. 
  30. ↑ "3.5. Limiting your program's environment". Freebsd.org. http://www.freebsd.org/doc/en/books/developers-handbook/secure-chroot.html. Retrieved 2014-01-15. 
  31. ↑ "IBM Fix pack information for: WPAR Network Isolation - United States". ibm.com. http://www-01.ibm.com/support/docview.wss?uid=isg1fixinfo109461. 
  32. ↑ Live Application Mobility in AIX 6.1
  33. ↑ 33.0 33.1 33.2 33.3 https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html#--property=
  34. ↑ 34.0 34.1 34.2 34.3 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/resource_management_guide/sec-modifying_control_groups
  35. ↑ https://aws.amazon.com/ecr/
  36. ↑ https://cloud.google.com/container-registry/
  37. ↑ https://docs.docker.com/ee/dtr/
  38. ↑ https://quay.io/

External links




Retrieved from "https://handwiki.org/wiki/index.php?title=Operating-system-level_virtualization&oldid=113366"