I've read many forums and blogs and articles comparing OpenVZ, KVM and XEN. And I have seen many times that one of the negatives of OpenVZ is that its less secure. However, I have yet to see an explanation as to how and why it is less secure other than the fact that OpenVZ uses a shared kernel.

I assume that if the host is compromised for any of these virtualization technologies, the containers can easily be accessed. So from that perspective, they are the same.

Is it easier to break out of the OpenVZ container and gain access to the host/other containers?

Is there some other way that OpenVZ is less secure?


closed as too broad by mdpc, dyasny, Ward, Falcon Momot, Jenny D Jan 20 '14 at 15:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Openvz containers are using the main node kernel to operate, each container doesn't have its own kernel this is called virtualization on the OS level so if there is an exploit in the main node kernel may lead to an hacker compromise the main node and gain access to it, in the other virtualization technologies like kvm or xen every virtual machine has its kernel.

But actually openvz didn't have a big history with exploits that's may lead to gain main node access. Any way i prefere kvm or xen or any full virtualization technology if iam interested in more safety.

If you are going to use openvz just make sure your kernel is updated.

  • 1
    edited sorry for my mistake openvz technique is close to paravirtualization with some differents. – user205537 Jan 17 '14 at 22:18
  • it's not virtualization it's simple containers. Basically, BSD jails with some extra fluff around. – dyasny Jan 17 '14 at 23:02
  • check it openvz.org/Introduction_to_virtualization – user205537 Jan 17 '14 at 23:31
  • I am aware of the shared kernel. Is that the only real security related difference? – mhost Jan 18 '14 at 0:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.