Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A group which I'm part of has grown and is about to move from using DigitalOcean VPSes to a single colocated server. At this point, we don't have a need to distribute our service very highly. This monolithic server will be running pretty much all of our systems, from our public-facing website to our mail service to custom daemons and control panels.

There has been concern, however, about the possibility of one service becoming compromised (we have been a target of intrusions in the past) and causing stability or a security breech in other parts of the server.

What we're looking to do is somehow "sandbox" certain services and processes, restricting the amount of resources (RAM, CPU) they're able to use. It's been suggested running each "set" of services on a different VM, but that seems clunky and difficult to maintain to me. I would think that Linux would have a more elegant way of handling this. Does anyone have any suggestions on the best way to accomplish this?

We're using CentOS 6.4 64 bit.

share|improve this question
Can't you just run these in separate VMs like everyone else does? – Chopper3 Aug 13 '13 at 17:22
"It's been suggested running each set of services on a different VM, but that seems clunky and difficult to maintain to me." - I was asking if that was the best way, or if there was a better way. – Connor Peet Aug 13 '13 at 17:24
Good point, well made, must remember to read every word of new poster's questions :) we get so much crap from most new users - sorry – Chopper3 Aug 13 '13 at 18:00
up vote 4 down vote accepted

A project called Docker has recently gotten a lot of attention for attempting to solve this very problem.

Docker is an open-source project to easily create lightweight, portable, self-sufficient containers from any application. The same container that a developer builds and tests on a laptop can run at scale, in production, on VMs, bare metal, OpenStack clusters, public clouds and more.

This technology takes advantage of Linux cgroups and a few other things to build jail-like "containers" that can contain all of the necessary resources and configuration to run a specific service, which can be managed kind of like packages, in that they can be distributed, versioned, and used on a wide variety of environments. (This is a gross simplification.)

See What are the Main Features of Docker to learn more about how it actually works.

share|improve this answer
Wow, that looks incredibly awesome, thanks for the answer! – Connor Peet Aug 13 '13 at 18:04

Traditionally you'd do this with a chroot jail but I strongly recommend putting them each in their own VM. Much better insulation from each other and you get better granularity when upgrading/troubleshooting/changing the services. Being able to restart/patch your web front end(s) with out taking the database server offline can be very nice, especially if you end up scaling out for redundancy.

The overhead of a CentOS box is quite small relative to most apps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.