The Penguin in the Sandbox
Virtualized Linux provides you with a way to sandbox critical-but-vulnerable services and reap the benefits of consolidated hardware.
Virtualization is the hot buzzword these days. Everyone is all excited over this latest, greatest miracle computer cure. It transforms your computing infrastructure into a shiny empire of efficiency and contentment, makes you an IT Hero and it repairs bad haircuts. So what are you waiting for? Hop on the virtualization bandwagon quickly, before it goes away forever!
Aw, I knew you wouldn't be that gullible. You want some actual data and information before making that kind of decision. Well OK then. Let us therefore examine this whole virtualization phenomenon. We'll take a peek at running User-Mode Linux, Xen, VMWare, chroot jails, Ensim, and OpenVZ on Linux. (Yes, I know there are others, and you're welcome to email me about them.)
Typically, virtualization means you have a single host operating system than runs multiple instances of the same guest operating system, or mixing different guest operating systems. Chroot jails don't fit either category, but they do fit the overall concept of running multiple services on the same box in safely isolated environments.
First of all, why? What's the fuss? Why is this even worth thinking about? The short answer is "under-utilized hardware". The second short answer is "consolidation".
System and network administrators struggle with the issue of how many services to put on a single machine, especially an Internet-facing machine. Physical separation adds security - if one service is compromised, it won't take down others. A hardware failure affects only a single service. But the price is added complexity, larger space requirements and more energy consumption. x86 hardware gives so much bang for the buck that a lot of machines are running at little better than idle speed. With affordable multi-processor machines and multi-core processors parading their enticing selves all over the places, what you we going to do with all that horsepower?
One Machine, Many Services
Consolidating services onto fewer machines is appealing because they are easier to manage, and you can put that unused capacity you already paid for to work. Or, when you buy new gear, get a single high-quality machine with redundant hot-swap server-quality everything, instead of a gaggle of lesser boxes.
Virtualization isn't a new idea; IBM's VM operating system has been hanging around since the early 70s, and today a single zSeries mainframe runs thousands of concurrent Linuxes. (Remember the famous IBM commercial, "The Heist"? That's what that was about.) Of course IBM wants you to blow a million clams on their stuff, but virtualization works just fine on lower-end systems too.
The basic concept in all virtualization technologies is sandboxing. Applications and operating systems run in discrete environments, completely protected from each other, and strictly limited in how many system resources they can consume. That's the theory, anyway. It's like having a whole bunch of computers in one, and they can interact with each other just like a physical herd of computers. It's a great development and testing environment, a test-lab-in-a-box. You can test networking, cross-platform applications, multiple Web browsers, and clustering. Use it for secure shared Web hosting, provide multiple secure user environments for shared PCs, and safely give them root accounts. The latter is especially useful for companies that have continual streams of perma-temps rotating through.
So Many Questions
But there are some obvious performance and security questions in such a setup. How much of a load can a system realistically handle? What if the whole works goes down because of a successful intrusion, runaway process, or some other system-wide catastrophe? What if someone just loads up the whole works into a van and drives it away? What if it's so freaking complex and difficult to administer you give up and retire to a hermitage?
So Many Answers
VMWare is the current champion of virtualization on x86. Software developers have long used VMWare on workstations, because it let them keep their nice Sun pizza boxes even as they were forced to interact with, or even worse, develop for Windows. While VMWare is a nice polished application, it carries a heavy performance price and requires some pretty stout hardware in order to function with a reasonable amount of peppiness. This is because all the work is done entirely in software. In contrast, the VM operating system runs on specialized hardware that handles the bulk of the virtualization load, so it delivers great performance.
But the times they are a a-changing, and there are two reasons why virtualization is suddenly all the rage: Xen, and x86 hardware support for virtualization.
The Xen Hypervisor
The Xen hypervisor is the new darling of the virtualization crowd. In case you were wondering, hypervisor (or sometimes virtual machine monitor) is the host system that supervises concurrent guest operating systems. Naturally, this is too cool to be merely a supervisor, so it's a hypervisor.
Xen operates in two ways: in software, or with hardware support. Xen's paravirtualization runs modified guest operating systems to achieve near-native performance. Open source operating systems like Linux, the BSDs and OpenSolaris already have Xen ports to run as guests. Several Linux distributions, NetBSD/xen, and OpenSolaris are available as ready-made Xen hosts in varying stages of polish.
As you've doubtless already noticed, certain major non-Unix operating systems are left out of the paravirtualization party. The team that developed Xen created a Microsoft Windows port under an academic license, but due to licensing restrictions cannot release it. But this doesn't matter if you have the right Intel or AMD CPU and Xen 3.0. Intel's Vanderpool and AMD's Pacifica are CPU instruction sets that allow unmodified guest operating systems to run side-by-side. Pretty slick stuff.
If the host operating system is compromised, or someone steals the physical machine, well, you're pretty much doomed. Even fancy new virtualization technologies can't help you.
Ease of administering virtualized systems depends on the implementation. Provisioning in some virtualization applications is fast and easy, and you can move operating systems and applications around freely. This translates into fast failure recovery, less maintenance downtime, and easy scaling, both up and down. Next week we'll look at some of pros and cons of some of the different virtualization applications for Linux.
- AMD's Pacifica revealed in full. Charlie Demerjian's five-part series is an excellent introduction to the new x86 virtualization technologies.
- Intel's Vanderpool site
- Hypervisor on Wikipedia is a nice overview of the progress from IBM mainframes to the present.
- OpenSolaris Community: Xen
- FreeBSD and Open Hypervisors