Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 8 down vote favorite
4

Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ or directly to LXC. I somewhere read LXC is not considered secure yet (ex http://en.gentoo-wiki.com/wiki/LXC#MAJOR_Temporary_Problems_with_LXC_-_READ_THIS) - is this still true? As I don't know the persons who run the guests I really have to take care of security.

share|improve this question
there were (are?) also problems with /proc filtering -- see bugs.launchpad.net/ubuntu/+source/lxc/+bug/645625 "lxc container can power-off host machine" – sendmoreinfo Mar 12 '12 at 22:15
not exactly an answer to your question, but have you considered using an hypervisor? eg. Xen or KVM – Luke404 Aug 6 '12 at 20:58
Xen and kvm have a much higher overhead and thus lower performance. I'd only use a hypervisor when I need a custom kernel in a guest, different host/ guest os or other "special requirements". – gucki Aug 7 '12 at 8:24

1 Answer

up vote 5 down vote accepted

To the best knowledge at the time of this writing there were still critical issues with /proc filtering. They ought to be addressed in Linux Kernel 3.6 or later.

Since I'm facing the same problem as you I've done some investigation and I'm not yet convinced that LXC is an alternative to Linux VServer.

If you decide not to switch to LXC have a look at the cgroup support of Linux Vserver which is based on the same code as LXC and may be an option for your setup.

share|improve this answer
+1 with cgroups, +selinux. Still KVM is better alternative. – GioMac Aug 21 '12 at 8:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.