Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Every time I need to create VPSs out of one of our machines, I (re)think the virtualization technologies, and seem to end up with OpenVZ being the most suitable for performance reasons when all I want is clean separation between VPSs. All running GNU/Linux.

The question I have is, for a scenario with the following facts, when is it ever more advisable to go for Xen? Here goes the situational facts:

  • I trust everyone who will be using the VPSs, the issue of virtualization security is not a concern
  • The host and guests will all be running GNU/Linux
  • Me and my team manage all the VPSs ourselves

Normally I would be comfortable with my decision to go with OpenVZ, but I keep reading about reputable engineers using Xen in scenarios that I imagine are very similar to mine, Github being one example.

share|improve this question

closed as too broad by pauska, Greg Askew, Dave M, dawud, Ward Sep 9 '13 at 1:03

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
I think about virtualization technology, but I have never found OpenVZ to be suitable for anything. –  Michael Hampton Sep 8 '13 at 12:57
    
I'd probably be using Linux LXC containers for this application. Xen would never come to mind for this. –  ewwhite Sep 8 '13 at 15:00
add comment

2 Answers

up vote 2 down vote accepted

OpenVZ containers have very low overhead and are easy to manage from the host. However, the main drawbacks of OpenVZ are fault tolerance and flexibility.

Code running inside an OpenVZ container could trigger a kernel panic that crashes the entire node. If you allow containers to act as NFS clients, an NFS hang could stall the whole system.

OpenVZ containers have to run the same kernel version as the host. They cannot insert kernel modules. Furthermore, they can only use Linux features that have been OpenVZ-virtualized, so you can't use autofs, for example (as of 2013).

If you know that you can live with these limitations, then by all means try OpenVZ. If it doesn't work out, it's not that difficult to switch to a full virtualization solution. (The outline of the process is: create a disk image, loopback-mount it, install a kernel, re-enable some inittab entries.)

share|improve this answer
    
I didn't know that code running in user-land could trigger a kernel panic. Is that really possible? –  Amr Mostafa Sep 9 '13 at 10:52
    
@AmrMostafa It's not supposed to be possible, but kernel bugs happen, and system administrators have to take that possibility into account like any other eventuality. –  200_success Sep 9 '13 at 11:10
add comment

You may trust the people who will be administering and using the VPSs, but can you trust the software? If a guest system panics, it may crash the entire node. If a guest system is vulnerable, then the entire node is at risk.

Of course, any hypervisor is also a piece of software, thus susceptible to bugs and vulnerabilities, but with smaller attack surface and stronger isolation than a container technology.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.