LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Containers
User Name
Password
Linux - Containers This forum is for the discussion of all topics relating to Linux containers. Docker, LXC, LXD, runC, containerd, CoreOS, Kubernetes, Mesos, rkt, and all other Linux container platforms are welcome.

Notices


Reply
  Search this Thread
Old 06-07-2017, 02:09 PM   #1
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 8,151
Blog Entries: 4

Rep: Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717
Anyone running lxd in a VMWare VM? Tell me about it.


I am considering largely-replacing a slew of VMWare VMs with (probably) just one, running an equivalent number of 'lxc' containers under Ubuntu and 'lxd'.

Is anyone out there doing that? Any thoughts? War stories? Experiences?
 
Old 06-07-2017, 03:47 PM   #2
Didier Spaier
LQ Addict
 
Registered: Nov 2008
Location: Paris, France
Distribution: Slint64-14.2 on Lenovo Thinkpad W520
Posts: 7,447

Rep: Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407Reputation: 2407
Just a question: why put the containers in a VM instead of on bare metal? Do you think that you will get a better isolation that way?

I would wonder if doing so could lead to a loss of performances (more CPU or RAM needed).
 
Old 06-08-2017, 08:28 AM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 8,151
Blog Entries: 4

Original Poster
Rep: Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717
Quote:
Originally Posted by Didier Spaier View Post
Just a question: why put the containers in a VM instead of on bare metal? Do you think that you will get a better isolation that way?
These will run in a cloud environment which basically offers two alternatives: VMWare, or OpenStack (using Linux's own virtual machine monitor on the inside). "Bare metal" is not an option that is available to this project.
 
Old 06-09-2017, 04:54 AM   #4
simosx
LQ Newbie
 
Registered: Jul 2005
Posts: 29

Rep: Reputation: 1
You will probably find some answers when you ask at the lxc-users mailing list, https://lists.linuxcontainers.org/listinfo

There should be no practical difference when you run LXD in a VMWare VM, assuming you are running a stock Ubuntu kernel which has all the necessary configuration that LXD needs.
Obviously make sure you use ZFS on a big fast device (like SSD), not on a loop file.
 
Old 06-09-2017, 04:00 PM   #5
justmy2cents
Member
 
Registered: May 2017
Location: U.S.
Distribution: Un*x
Posts: 131

Rep: Reputation: Disabled
The bandwidth between two VMs inside Azure even with a 40 gigabit network adapter on each VM, is only around 4Gbps; but with Azure's FPGA accelerated networking, that goes up to 25Gbps with 5 to 10x less latency (depending on your application).. Containers are more efficient than whole-system virtualization and is why companies are adopting them (it also attracts young talent as they like to work with the bleeding edge). The cost of this new approach however is that admins need to learn new security and management skills and tools..

Last edited by justmy2cents; 06-09-2017 at 04:12 PM.
 
Old 06-11-2017, 03:00 PM   #6
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 8,151
Blog Entries: 4

Original Poster
Rep: Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717
I don't like to use "mailing lists." I want summarized information and best-practices that I can efficiently use now.
 
1 members found this post helpful.
Old 06-12-2017, 10:27 AM   #7
justmy2cents
Member
 
Registered: May 2017
Location: U.S.
Distribution: Un*x
Posts: 131

Rep: Reputation: Disabled
The last one is particularly important as Linus brought it up himself in one of his recent talks..

Code:
* Containers enable companies to package up and isolate applications with all the nessesary files for each to run. This makes it easy to move containerized apps
  to different environments while retaining their full functionality. Containers are nothing more than Linux processes with a restricted view of the machine
  they're running on. With containers a single kernel runs multiple seperate, walled-off userlands (ring 3 stuff). There's no emulation, no seperate memory
  spaces, or virtual disks. A single kernel just juggles multiple processes in one memory space, as it was designed to do. To the kernel their just ordinary
  programs.. This is all good, however there's only one kernel so you can only run Linux containers on Linux, and if an app in a container needs an OS update,
  then everyone gets it, as there's only one OS to perfrom that update (and the whole machine must be rebooted). 
* You can write a barebones container with just a few lines of Go..
* Lxd offers most of the functionality of Xen or KVM-style Linux-on-Linux virtualization but with greater efficiency. 
* Lxds share nothing but the kernel so they can contain different LINUX distros than that of the host; with the caveat that those distros must work with kernel
  of the host's version of Ubuntu.. It uses btrfs or zfs to provide snapshotting and copy-on-write. Block devices on the host such as disk drives,
  network connections, almost anything can be dedicated to particular containers. You can limit the alotted resources and even dynamically change as needed
  (i.e. CPU cores. RAM, etc). You can also pin containers to partiulcar cores... 
* Software Containers differ from sandboxes in that they assume everything within it is considered dangerous. Many containers today are built around an app and
  isolate attacks from spreading to other parts of the OS. There are also container-based configurations such as chroot jails.. 
* The host's /proc holds information about all the containerized processes. This includes environment variables, which are also stored in the /proc pseudo-filesystem,
  meaning that your host machine has access to the environment for all your running containers. This potentially has security consequences if you're passing
  secrets like certificates or database passwords into your containers through environment variables. Also containers have no mechanism for detecing the need
  for updates, or for automatically updating, and can, therefore, be a source of vulnerabilties in themselves. But universial packages (such as Flatpak or Snap) can
  can add another level of security by installing in containers that isolate them from the rest of the system..
* Containers are more efficent than whole-system virtualization and is why companies are adopting them. The cost of this new approach is that admins need to
  learn new security and management skills and tools. 
* Some serious threats of containers can include DDOS at the application level, and use of insecure apps to flood the network and affect other
  containers 
* "LXD is a pure container system that looks as much as possible like a full hyperviser, without actually being one"
* Containers by themselves are not secure and is why namespaces should also be used

Last edited by justmy2cents; 06-12-2017 at 10:28 AM.
 
Old 06-13-2017, 07:33 AM   #8
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 8,151
Blog Entries: 4

Original Poster
Rep: Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717
This is simply a quotation of readily-available information. I'm looking for experiences.

Incidentally, the fact that /proc includes environment variables for anyone has always been seen as a security issue in Linux. Environment variables are too-often used in, for example, PHP store-software packages, to communicate things which ought not be communicated, specifically passwords. (Which are often GRANT ALL PRIVILEGES passwords set up by lazy programmers.)
 
Old 06-13-2017, 10:05 AM   #9
justmy2cents
Member
 
Registered: May 2017
Location: U.S.
Distribution: Un*x
Posts: 131

Rep: Reputation: Disabled
Yeah that was just my 2c, nevertheless thanks for that tid bit of information about /proc
 
Old 06-13-2017, 07:35 PM   #10
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 8,151
Blog Entries: 4

Original Poster
Rep: Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717Reputation: 2717
Quote:
Originally Posted by justmy2cents View Post
Yeah that was just my 2c, nevertheless thanks for that tid bit of information about /proc
It has been a vulnerability, so to speak, of Linux all along.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Running Linux on a Macbook Pro then running OSX via VMWare grubber33 Linux - Laptop and Netbook 5 03-10-2017 08:51 AM
[SOLVED] VMware is running extremely slow and very unresponsive on FC 23 with VMware Player 12 cyberdome Linux - Software 2 02-21-2016 06:16 PM
Is it possible to shared vmware files between two vmware applications running on two redhatwannabe Linux - General 1 06-18-2010 07:18 AM
vmware error: running vmware-config-tools.pl grap-pack Linux - Newbie 1 12-02-2008 01:38 PM
I tried ReactOS in VMware and now VMware is running really slow MegaSvensk Linux - Software 7 09-30-2007 02:10 PM


All times are GMT -5. The time now is 07:20 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration