Slashdot Mirror


OS Virtualization Interview

VirtualizationBuff writes "KernelTrap has a fascinating interview with Andrey Savochkin, the lead developer of the OpenVZ server virtualization project. In the interview Savochkin goes into great detail about how virtualization works, and why OpenVZ outshines the competition, comparing it to VServer, Xen and User Mode Linux. Regarding virtualization, Savochkin describes it as the next big step, 'comparable with the step between single-user and multi-user systems.' Savochkin is now focused on getting OpenVZ merged into the mainline Linux kernel."

184 comments

  1. I'm not convinced... by SGrunt · · Score: 2, Interesting

    ...that virtualisation is going to be that much of a Big Thing(tm). Those that will get the most use out of it will be the would-be dual/tri/mega-booters, and, let's face it, compared to the number of computer users in the world - heck, to the number of people that know roughly what virtualisation is - that number is going to be quite small.

    1. Re:I'm not convinced... by jgold03 · · Score: 3, Insightful

      well isn't Linux used mostly for server operations? Virtualization also adds a layer of safety and security between child OSes and their processor.

    2. Re:I'm not convinced... by Sqwubbsy · · Score: 0

      Do you have any specialized server that don't warrant their own full DL360 or whatever your low-end rackmount is? Do you have multiple processes that, while constant an ongoing (think mail routing) don't require ALL of the system resources?
      The key to Virt is that you don't have to reboot, but can run multiple OS's/processes side-by-side. This is good for testing and deployment for one, but for largely autonomous server processes for another.

      Just because you don't have a use for the tech doesn't mean it's worthless.

    3. Re:I'm not convinced... by Abcd1234 · · Score: 5, Insightful

      Uhh... these products aren't aimed at your desktop box. They're for use in server farms, where virtualization provides an additional measure of security, along with providing the server operator more flexibility in how their hardware is utilized.

    4. Re:I'm not convinced... by NitsujTPU · · Score: 4, Insightful

      Nah nah nah. It's going to be great. Picture this. You manage a university computer lab. The computers all have identical software, and all of the students files are stored on a network share. When computers are not in use, you'd like to dedicate the cycles to a long-standing distributed computation for experiments carried out by one of the departments.

      The student logs in and a disk image runs their OS of choice, they don't have to reboot or know much, they just click an icon saying which OS, which instantly is presented to them. A batch process manager removes the load from the distributed experiment from their machine.

      Or, perhaps something that's already fielded. You're a graduate student, and want to emulate 1000 compute nodes for a distributed computing experiment, you log into emulab, and tell the 50 that you've signed up for to boot 20 OS's a piece, and emulate a 1000 node network.

      Or, perhaps you're studying viruses (this has also been done), and want to build an Internet scale honeynet.

      Or, perhaps you're running a large server farm. You want an easy way to load balance a multitude of services, so you can run something that looks like 100 servers on perhaps 50. By dynamically balancing across nodes, services can automatically adjust themselves, independently of mechanisms built into their software (to some degree). When you want to add new hardware to the network, you just plug in the machine, and tasks start being farmed to it. When you want to retire some, you just tell the manager to stop moving tasks onto that machine, and wait for the tasks on that machine to move off.

      Briefly put, VMMs rock. You have to think outside of "geeks playing with VMWare" to really see the interesting applications though.

    5. Re:I'm not convinced... by dsginter · · Score: 2, Insightful

      I'm not convinced that virtualisation is going to be that much of a Big Thing(tm).

      Allow me to introduce you to the world of Big Business: upper management want the Big Business pay check but, post dot-bomb bubble, they want none of the penalties associated with taking a risk. So you have the "one application per box" mentality. All of a sudden, you've got 20 boxes running at 5 percent utilization.

      Can you see where virtualization would provide "virtually" the same thing with better cost efficiency?

      Make no mistake, virtualization is just as much about pleasing management as it is about making sense.

      --
      More
    6. Re:I'm not convinced... by Anonymous Coward · · Score: 0
      well isn't Linux used mostly for server operations?

      No.

      Or, in more detail, as measured in dollars-of-revenue, perhaps the biggest segement for Linux is servers; since that's what vendors sell --- but in units and in amount of work done workstations is a far bigger market.

      For example, here we have paid subscriptions RedHat's on the servers, and free-copies on the workstations -- but the workstations outnumber servers by a dozen-to-one.

    7. Re:I'm not convinced... by Anonymous Coward · · Score: 1, Interesting

      Parent wrote: <i>as measured in dollars-of-revenue,perhaps the biggest segement for Linux is servers; since that's what vendors sell --- but in units and in amount of work done workstations is a far bigger market.</i>

      Indeed dollars of revenue is a uniquely poor way of measuring the success of software.
      The best analogy I've heard is market research of
      breathable gases.   Any market research company
      would happily conclude that that Tobacco
      Smoke is a far more desirable breathable substance
      than air.   Just look at the revenue numbers:
         Cigarettes - $48.7 billion in 1997
         Cigars     - $ 0.9 billion in 1997
         Fresh Air  - $ 0.0 billion in 1997
      So the obvious conclusion is that if you're a business
      the revenue figures obviously show that best
      practices in the industry is to use smoke.

      Absurd, yes; but it seems that's how most corporations
      pick their databases and operating systems.

    8. Re:I'm not convinced... by timeOday · · Score: 1

      I don't see why such a layer is necessary, or what it will ultimately provide. The OS is supposed to protect users and apps from each other! If virtualization becomes widespread, it will have to take on more and more of the roles of an OS until it *is* an OS. For instance, an OS has a bunch of logic (a scheduler) to grant processes "fair" access to the CPU. With virtualization, you need another scheduler to schedule among the schedulers!!

    9. Re:I'm not convinced... by subgrappler · · Score: 1

      sure, it might not ever become a household word... but it will on the backend, have a big overall effect in general whether anyone is aware of it or not. but more people have been introduced to running an OS on an OS... OS9 on OSX? and just this week i told 3 different people about vmware workstaiton/player as a way to run their old apps.

    10. Re:I'm not convinced... by BrainInAJar · · Score: 1

      Exactly. something to sit above the kernel, or "supervisor"... something like a "hypervisor", which is exactly what xen's marketing department wants us to call the xen kernel

    11. Re:I'm not convinced... by Anonymous Coward · · Score: 0

      There are just so many uses for virtualization it's not even funny. Lots of good ones have already been mentionned. Personally, I just couldn't live without it. I already have a half dozen PCs, one of which is used only as a VM server, just so I don't have to have an extra couple dozen PCs laying around. It's handy to be able to fire up any kind of OS/app combination you need at any time you so please, like big DB servers you don't always need (Oracle; I mainly use it for compatibility tests and porting stuff) or just server stuff (like Active Directory - without needing a bunch of spare PCs), lets you have almost any Linux distro you'd like ready to go, test software - and software deployment in various ways - on various OSes easily, etc. This list of possible/practical uses is almost endless. Perhaps not everyone needs to do this in a home setup, but that's totally irrelevant, and doesn't make it less useful at all. We're also definitely having a serious look at VMWare's new free offering (used to be called GSX) for our next batch of servers - consolidation is where it's at. At the price we're paying for the servers (including support and all), we might as well make good use of them instead of order a bunch more that'll sit mostly idle, just costing more (in electricity/AC/purchase/support) and perhaps take up space.

    12. Re:I'm not convinced... by kesuki · · Score: 2, Interesting

      actually, the virtualization software or the 'host OS' itself handles the scheduling. in server farms quite often the virtualization software runs 'bare metal' (eg: the system boots straight into the virtualization software, and loads any images etc.) but most geeks run it on top of a full fledged Os where the software can rely on any built in shcedulers etc. I have noticed that certain devices (soundcards, for example) don't always play nicely with being shared, but others (LAN cards) handle being shared very transparently. there is room for improvment in sound cards, saddly there seems to be little motivation to innovate. sytle over substance seems to be the name of the game, although in this case that means 'sounds clearer' over actually being able to processes multiple simultaneous audio effects.

      well there is the Audigy 2 X-Fi series, which on paper is a dramatic improvement, but is 8 simultaneous real-time sound events fast enough? I just kinda wonder because in the games I play (online), most people use hot keys to toggle sound effects anyways.

      besides which i'm not even sure if the audigy x-fi cards would even work properly with virtualization software. but, i can't think of another card with as much technical capability for generating sound effects. although i'm not that familiar with the $1000+ range products on the market.

    13. Re:I'm not convinced... by Spy+der+Mann · · Score: 1, Insightful

      Uhh... these products aren't aimed at your desktop box. They're for use in server farms, where virtualization provides an additional measure of security

      If windows apps (or group of apps) were virtualized, we could use activex webpages without having to worry about spyware. Just close the virtualization window and it's gone.

      The same for e-mail, if you restrict write access only to the mail files, and all spawned process from the e-mail were virtualized. If it screws up, the most you lose is your e-mail, but no viruses or infections would be produced.

      What to say of websites? Virus^H^H^H^H^Hfree games installation would be only temporary (or perhaps session based? Hmmmm interesting) and you wouldn't have to worry about becoming a botnet.

      So yes, virtualization for Windows would be awesome.

    14. Re:I'm not convinced... by billcopc · · Score: 2, Insightful

      That's brilliant, instead of actually expecting secure software, let's just use a 40 pound sledge to drive a nail. Virtualization means running a nested kernel, I don't feel like booting a sub-OS everytime I want to check mail or open a browser. It's far more efficient to just write the app properly.

      I guess the true question is: Which solution is more likely to get attention ? Whiz-bang virtualization will probably win, since it seems very few people in this world have the patience and discipline to write respectable code anymore.

      --
      -Billco, Fnarg.com
    15. Re:I'm not convinced... by Spy+der+Mann · · Score: 2

      Virtualization means running a nested kernel

      No, it isn't. Didn't you RTF... oh, right, this is slashdot. Nevermind. :P

    16. Re:I'm not convinced... by Forbman · · Score: 1

      Or, perhaps you're running a large server farm. You want an easy way to load balance a multitude of services, so you can run something that looks like 100 servers on perhaps 50. By dynamically balancing across nodes, services can automatically adjust themselves, independently of mechanisms built into their software (to some degree). When you want to add new hardware to the network, you just plug in the machine, and tasks start being farmed to it. When you want to retire some, you just tell the manager to stop moving tasks onto that machine, and wait for the tasks on that machine to move off.

      You mean like the guys who wrote an article for Linux Journal about running SuSE Linux on an IBM Z-Series mainframe, partly to evaluate it with the Evolution server, and had like 6000 (or 60K?) virtual servers up, all running the Evolution server (and serving clients) quite nicely?

      If it worked good enough, a couple of beefy (beefy as in lots of LPAR hardware) Z-Series could host quite a few virtual webservers vs racks and racks (or racks of blades) of PC hardware... The advantage of Linux in this instance scales as well...

    17. Re:I'm not convinced... by mcrbids · · Score: 1

      If windows apps (or group of apps) were virtualized, we could use activex webpages without having to worry about spyware. Just close the virtualization window and it's gone.

      On more than one occasion, I've trolled the warez sites for a "key generator". These are programs that you run that give you a workable key for a particular software product - but they are almost ALWAYS loaded with spyware and other easter eggs.

      But, with VMWare, it's no big deal. Take a snapshot, download the generator & run, write down key, revert to snapshot. Snap! Done!

      I treat such software products as a sort of "try before you buy" - and I've bought numerous products after reviewing them in this manner. (For example, Qarbon, Dreamweaver, PC/Anywhere)

      VMWare is really, really cool, though - there's nothing quite like running 3 or 4 virtual systems in a coordinated network application, all on your laptop while in the airport waiting for the plane to land, to really see what it's all about.

      Also, my Windows VM has b0rk3d itself several times after an otherwise innocent update or something, and in the case of a physical install, I would have had to re-install. But, with VMWare, I just revert to snapshot, and 5 minutes later, I'm back up and runing.

      SWEET!

      Redhat Fedora Linux makes a *great* host O/S for software development, especially when combined with VMWare. What's more, VMWare is FREE!

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
    18. Re:I'm not convinced... by Anonymous Coward · · Score: 0

      Allow me to introduce you to the world of Big Business: upper management want the Big Business pay check but, post dot-bomb bubble, they want none of the penalties associated with taking a risk. So you have the "one application per box" mentality. All of a sudden, you've got 20 boxes running at 5 percent utilization.

      Hear, hear! Though you know that the incompetent operations management who insist on "one application per box" regardless of the details of the situation are going to rebel against virtualization, too. Virtualization can only greatly reduce the risk of running multiple applications per box, not eliminate it entirely. Since their approach to risk management is "any risk that can be avoided must be avoided at any cost", they will not accept virtualization. And, of course, that fact that many in Big Business outsource operations to a third party who would lose fee money if servers were consolidated is just another strike against virtualization.

      Make no mistake, virtualization is just as much about pleasing management as it is about making sense.

      I may be a cynic, but I don't think it will please operations management types, despite being a good idea overall.

    19. Re:I'm not convinced... by Errtu76 · · Score: 1

      I disagree. In the last couple of months, we've virtualized almost half our network. About 20 servers that used to run on physical hardware now runs on one of our four VMWare ESX servers. Everything runs more than fine, without paying alot for the hardware. Granted, the machines that ESX runs on are quite bloated, but hey, if you can run about 8 servers on 1 machine you'll find that the costs aren't that big anymore. No, virtualization has come a long way since the first time i used it to boot linux inside windows (and vice versa).

    20. Re:I'm not convinced... by shmlco · · Score: 1

      "It's far more efficient to just write the app properly."

      That's right. But how many do? I mean, it's not as if most application developers deliberately set out to write buggy insecure software.

      Being able to, say, bring up a perferences dialog and totally sandbox an application would be cool. After all, do you really trust that utility you just downloaded? Should that browser have full access to your system.

      And as to "booting a sub-OS", you obviously haven't used an OS 9 "Classic" app on OS X. You just double-click it and it runs. Such can happen automatically, behind the scenes, without intervention.

      --
      Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
    21. Re:I'm not convinced... by pnuema · · Score: 1
      Please forgive me for copying my own post, but I'm lazy.

      I'm a performance tester who has had to completely reinvent how we do business thanks to virtualization. How do you give assurances to an application that they will perform adequately in a virtual environment when by definition performance will always be dynamic?

      The primary approach we have had to take was to stop looking at whether an app will perform on a virtual machine, and start looking at whether or not it will be cost effective for the app to perform virtually (in general, apps that will perform in the physical world can be made to perform in the virtual world if you throw enough resources at them). After a certain point, it becomes cheaper to run the app on a physical server.

      It's an interesting problem. We found that our company's big push into virtualization had to be scaled back a bit - not every server is truly a good candidate for virtualization.

    22. Re:I'm not convinced... by ovz_kir · · Score: 2, Interesting

      I know some people who use Virtuozzo, OpenVZ or Linux-VServer to host a single VPS. This does not makes sense from the first sight, does it? What about the second?..

      The idea is virtualization (OS-level virtualization) provides some benefits without sacrificing much of anything. So what it provides?

      Virtual Environment (VE) do not depend on the hardware, so you can move a VE to another box without changing anything. Every sysadmin will love that. No need to edit /etc/fstab or /etc/modprobe.conf.

      VE can be cloned. If you want to change something but afraid it will not work, you clone your VE and change the clone.

      VE can be migrated to another physical server live (with no service outage -- to networked users it will be seen as a delay in response, not as any downtime). We are releasing this feature for OpenVZ this week.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    23. Re:I'm not convinced... by jefu · · Score: 1
      I disagree. I think virtualization is going to be an incredibly useful too - all the more so if microsoft would allow windows to be virtualized easily (perhaps on top of a nice fast exokernel). And I think it has the potential to hit home use big time. For example (there are lots of others) : if you have such a machine you could give everyone in your family a new virtual copy of windows (or linux or macos) to run on the same hardware, which might be a multi-core processor and use remoteing (and remoting with virtual machines opens up some fun possibilities) to make things happen on a very light screen/keyboard (or tablet or phone or...) on a wireless network. Encrypt (if you want) the images and now everyone has a secure machine. Dad can do his checkbook without worrying about anyone messing it up or the kids being able to see whats up, mom can do her checkbook, you could set up restricted virtual machines for the kiddies. Games might run virtualized...

      And you could share parts of the file system if the exokernel managed SMB shares (if you wanted), you could run a webserver with calendars and such for all to share, you could run asterix in a VM to handle your phone...

    24. Re:I'm not convinced... by demon · · Score: 1

      Well, actually that term was coined well before Xen came around. I'm pretty sure the VMM that's part of z/VM on IBM's machines was referred to as a "hypervisor" as well - and it far predates Xen's use of the word.

      --

      Sam: "That was needlessly cryptic."
      Max: "I'd be peeing my pants if I wore any!"
    25. Re:I'm not convinced... by billcopc · · Score: 1

      Mac Classic may run some level of virtualization, but it certainly doesn't shield your OSX from any nasties the classic app might try to pull, it offers no sandbox for YOUR data, it only protects the OSX kernel. What we're discussing here is virtualization as a magic hammer to stamp out mass spreading viruses and data loss, essentially a condom for your app.

      In addition I'd like to say that while developers don't deliberately insert vulnerabilities in their code (unless they're crooked scammers), there can often be a high level of laziness and apathy with regards to careful coding. It's far more fun to quickly bang out a kludge that works 90% of the time, rather than follow proper design strategies and run thorough unit tests. Maybe I'm lucky, maybe I'm special, I have a paranoid mind and I do extensive error checking and extend NO trust when dealing with user input. These things are obvious to me, as I'm writing code I know exactly what I want and don't want from it, and so I add sanity checks instinctively.

      Here's an easy example: just compile a few linux packages, just pick from the basics and see how many warnings GCC spouts, and the severity of those warnings. The easy ones sometimes get rewritten, the hard ones get masked off. There are so many half-assed kludges in typical C code that it's no surprise everything's segfaulting left and right.

      What's worse now with "data execution prevention", or the much sexier term "NX bit", is seeing how many apps break the data separation rules. I had a simple app a few days back, a RAD app no less, that refused to run with NX enabled. Now why the hell would a RAD app (in this case Delphi) need to copy data into a code segment ? It certainly wasn't doing any fancy JIT compilation, and even JIT can be done safely with the proper techniques. The last time I did anything of the sort was 1996 when I was writing brutally optimized assembler for graphics routines.. lots of self-modifying code and reverse data execution there :)

      --
      -Billco, Fnarg.com
    26. Re:I'm not convinced... by shmlco · · Score: 1

      "Mac Classic may run some level of virtualization, but it certainly doesn't shield your OSX from any nasties the classic app might try to pull, it offers no sandbox for YOUR data..." All true, but I brought it up only to refute the "having to boot up some virtualization layer" argument. Properly done, the virtualization or sandboxing would be invisible.

      --
      Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
  2. OT question by tomstdenis · · Score: 1, Insightful

    What's with "open" in the name of all these projects. Is anyone really impressed by that anymore?

    Tom

    --
    Someday, I'll have a real sig.
    1. Re:OT question by SGrunt · · Score: 1

      At least it's a good indicator that it is OSS. Given an IT guy who's advocating the use of the stuff it might impress the boss now and again.

    2. Re:OT question by tomstdenis · · Score: 2, Insightful

      Bosses don't care if it's open source. They care

      1. How much does it cost to license
      2. How much does it cost to setup
      3. What does it solve any better than what we already have.

      Tom

      --
      Someday, I'll have a real sig.
    3. Re:OT question by Kyro · · Score: 1

      4. Who can we sue if it breaks

      --
      save the GNUs!
    4. Re:OT question by SGrunt · · Score: 1

      ...the lack of a reasonable answer to this is part of the reason there hasn't been a wider adoption of OSS. :)

    5. Re:OT question by subreality · · Score: 3, Informative
      What's with "open" in the name of all these projects.


      In this case it's an OSS version of a closed-source product called Virtuozzo, commonly abbreviated VZ. I think it's a perfectly descriptive name.
    6. Re:OT question by tomstdenis · · Score: 1

      Well if it's the closed project it's opened up.

      If it's a clean-house implementation then it's not strictly based on it.

      Call it something else like Vzeeforefree!

      Dunno just annoyed at people abusing the OSS blanket for publicity.

      Tom

      --
      Someday, I'll have a real sig.
    7. Re:OT question by jmv · · Score: 2, Insightful

      Just curious, who do you usually sue when Windows breaks?

    8. Re:OT question by Kyro · · Score: 1

      Good point :)

      I guess the supplier (IBM/HP/Dell whatever) is usually accountable for any breakage that occurs. Failing that, you can call any of the billions of small tech shops that fix Windows installations for enourmous amounts of cash (I used to work for one ;))

      --
      save the GNUs!
    9. Re:OT question by jmv · · Score: 2, Insightful

      Ask for support != sue. You can ask your Linux distro vendor for support too. I have yet to see any successful lawsuit over a Windows fault.

    10. Re:OT question by NitsujTPU · · Score: 1

      It's doesn't really matter. It's more about having someone to blame than actually extracting money out of them.

      If everyone else is using Windows, and you want to use Linux, you're the black sheep, so they blame you. On the other hand, if Windows has a glitch, you whine about Windows a bit, and then everyone else on the planet does (because you better be running the identical configuration or, again, it's your fault).

    11. Re:OT question by subreality · · Score: 1
      It's a closed commercial product, and they forked and GPLed a subset of the source.

      Dunno just annoyed at people abusing the OSS blanket for publicity.

      Where do you think Firefox came from? Do you think releasing Mozilla was abusive?

      I don't think everything needs to be done for wholely untainted altruistic reasons. It's not like they're throwing out some old bones to chew on. This is an actual useful bit of software.
    12. Re:OT question by jmv · · Score: 1

      It's more about having someone to blame than actually extracting money out of them.

      Got no problem, I always blame Linus anyway :-)

    13. Re:OT question by Kyro · · Score: 1

      You can sue if they don't fix what is covered in the support contract. Also, there is millions more windows support shops around than linux support shops. Besides, since when has management made a logical decision?

      (I'm not a windows user btw, I'm just saying that's what management does these days.)

      --
      save the GNUs!
    14. Re:OT question by 5t3ph2n · · Score: 1

      I don't think it's there to impress. It does make it directly clear that this is an opensource project.

    15. Re:OT question by tomstdenis · · Score: 1

      They don't call it OpenNetscape now do they?

      Tom

      --
      Someday, I'll have a real sig.
    16. Re:OT question by tomstdenis · · Score: 1

      Who supports users? How about the author of the damn tool?

      It's called personal responsibility.

      Unfortunately all too many people want the credit for writing OSS [no matter how shoddy] but don't want the actual work of supporting it. How many OSS projects are known for their stellar documentation and 24 hour turnaround e-mail support?

      Not that the commercial world is any better. I mean who do I write to, to get a behaviour in MS Word changed?

      Tom

      --
      Someday, I'll have a real sig.
    17. Re:OT question by mytec · · Score: 1

      4. How much the software costs to maintain over its lifetime. Administration, for example.
      5. The downtime, if any, for upgrades. How much and what is the cost?
      6. How new is the software? Could the software in it's current state run for as long as needed with the exception of significant performance improvements or security updates? If not, #5 comes into play.

    18. Re:OT question by porttikivi · · Score: 1

      In the 80's they still said that everybody is buying IBM equipment because nobody was ever fired for that. I guess these days "nobody is ever fired for building a Windows based system".

      --
      Anssi Porttikivi / app@iki.fi
    19. Re:OT question by Hal_Porter · · Score: 1

      The fear of a lawsuit / lost sales definitely affects Microsoft's behaviour. If you look at the Old New Thing, or the lists for beta release software, they clearly spend enormous resources keeping old, broken, third party applications alive.

      That said, if I found an actual bug in Windows in my application, I'd just workaround it for much the same reason.

      And it's interesting how if I talk to Open Source people, they think this is all wasted effort.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    20. Re:OT question by NitsujTPU · · Score: 1

      I almost cited that :-D

    21. Re:OT question by subreality · · Score: 1

      OK, I missed your point before, because I'd never even considered picking THAT nit. :)

      You consider it abuse when they call it Open even when it's a real product being released under a real OSS license. Under what circumstances would you consider the word "Open" to be NOT abusive?

  3. So it's a VMWare ESX Server clone ? by MarkTina · · Score: 1

    What's the distinction between what he is talking about and something like VMWARE ESX ?

    1. Re:So it's a VMWare ESX Server clone ? by silas_moeckel · · Score: 3, Informative

      ESX is a lot thicker than openVZ meaning it's emulating a lot more so more overhead. ESX is also more flexable as it run run windows next to lnux next to solaris next to insurt x86 thing here assuming they can deal with it's limited scsi emulated hardware. OpenVZ on the other hand uses one kernel and one filesystem it's one step up from a chrooted jail with a lot of process type limitors similar to ESX. The single filesystem realy keeps drive usage down with a copy on write scheme for the virtuals and you can update all the virtuals at once by altering the base filesystem. OpenVZ was designed for there virtuoso product line thats tageted at hosting companies who have been the big adopters of virtulization as it's a lot safer to sell 1/10th of a 3k server than 10 300 buck "servers" where the 3k box has raid redundant psu's and only takes up one RU vs 10 minitowers taking up nearly a rack and consuming a lot more power with no redundancy.

      --
      No sir I dont like it.
    2. Re:So it's a VMWare ESX Server clone ? by hawg2k · · Score: 1

      VMWare's ESX server, and Xen as well, are called hypervizors. As I understand it, that's just a fancy name for a specialized appliance like OS. Basically, you can't do much with a hypervizor except get virtual machines up and running. From the article it sounds like OpenVZ requires the full blown Linux kernel as well as most of your basic GNU/Linux code. So, if I understand correctly, you could use the "host" as an actual computer as well as a virtual machine manager. Sounds like you get some COW type features etc. too, allowing for some file sharing between the host and the guest(s), if I understood the article correctly.

    3. Re:So it's a VMWare ESX Server clone ? by Anonymous Coward · · Score: 0

      whoa. try taking a basic grammar class. i doubt anyone can understand one word of what you said.

    4. Re:So it's a VMWare ESX Server clone ? by swmccracken · · Score: 1

      I think the main difference is the split between the hypervisor and userspace. (A hypervisor is a scheduler that manages multiple operating systems, each of which has their own scheduler. The original operating systems were called "supervisor programs", in case you're curious, so a supervisor-supervisor-program is a hypervisor. :-)

      Under VMWare, each VM runs with its own complete kernel copy - each VM is a complete emulation of a computer, to the best of VMWare's ability.

      Under OpenVZ, as far as I can tell, the same kernel is shared among the different VMs and they add extra "namespace" features to the kernel that allows the one kernel to segregate the virtual machines. Because it's still the one kernel, there's more efficency because the one kernel manages the virtual-memory to physical memory mapping and all the other hardware abstraction issues. (Instead of the double layer of the VM ("guest") OS to virtual hardware to the host OS to physical hardware.) If I'm right, this means that a kernel has to be well written to avoid VM contamination, a kernel panic will bring the whole system down (not just one VM), and you can't have different kernel versions or images in each VM.

      What I want to know is "how is this in comparison to zones on Solaris?" It looks a lot like that.

  4. Virt is big by Anonymous Coward · · Score: 1, Interesting

    I disagree, I think this is going to be big and is already starting.. In the corporate world, we have been moving many legacy systems onto VM's. Win2k3 also runs on VM's very nicely, great way to utilize that server you use for print/virus/iis, each having a seperate OS on same hardware. I think the VM buzz is really hitting much more mass right now. We are looking at mass roll-outs for desktops to get away from dual booting win/linux and would prefer to see this virtualised, as would clients.

  5. Sweet by Sqwubbsy · · Score: 0

    Just started mucking with Virtual Server 2005 R2 and have been pretty psyched about the results (especially with not having to req development machines which is nigh on impossible in my organization.)

    But I don't see this is emulating an x86 machine, rather it seems to just be a Linux virtualization environment. Yes, I did RTFA, and I've looked at the website, but I'm wondering if another slashdotter has ever actually used the tool and can answer this.

  6. Virtu. Linux/Windows Dual Boot by Anonymous Coward · · Score: 0

    I dual-boot Windows XP and Linux. Is there a software virtualization solution that will allow me to convert/use my current Windows partition?

    1. Re:Virtu. Linux/Windows Dual Boot by Fuyu · · Score: 1

      VMware's P2V Assistant http://www.vmware.com/products/p2v/ will allow you to convert your current Windows partition into a VM.

    2. Re:Virtu. Linux/Windows Dual Boot by BrainInAJar · · Score: 1

      xen 3 and an amd pacifica/intel VT chip?

      wouldn't be the first time

  7. Price? by XanC · · Score: 2, Insightful

    For one. VMWare ESX is quite expensive, I understand.

  8. A bit of bias... by subreality · · Score: 5, Informative

    "why OpenVZ outshines the competition, comparing it to VServer, Xen and User Mode Linux."

    Of course, Andrey works for the software company that wrote this thing, and their closed full-featured flavor, Virtuozzo. The VZ method is a good one, and has excellent performance, but it has its drawbacks, too. Personally, I don't like that my VPSes need to use my VPS provider's kernel, which lacks features I desperately want (like stateful iptables matching), and which forces me to reboot whenever they upgrade their kernel (my VPS can't be migrated to a host running a different kernel), and I can't upgrade until my provider does.

    VServer, Xen, and UML all make different tradeoffs. VZ goes for performance. Saying one outshines the others is just trolling. That's mostly on the part of the /. submitter, but Andrey slants it a little too.

    I don't want to crap on the OpenVZ project. They're working on very cool stuff, and I applaud SWSoft for opening the thing up. I just want people to keep the comparisons in context.

    1. Re:A bit of bias... by Anonymous Coward · · Score: 0

      IMHO OpenVZ doesn't go for performance, because their code adds bloat where it isn't required, and the network virtualization adds more overhead than necessary, no wonder that VServer outperforms it on many benchmarks.

    2. Re:A bit of bias... by Anonymous Coward · · Score: 0

      numbers please! :)

  9. It's hot...it's coming...and you are left wonderin by threedognit3 · · Score: 0

    Virt...is the real deal. A new way of doing things. Ground floor stuff but if you don't stay up on it...you lose.

    This is the cool stuff, the amazing stuff.

  10. OS virtualization by Cthefuture · · Score: 4, Insightful

    Unlike Xen or VMware this OpenVZ doesn't run a separate kernel for each virtual machine. This seems like a security risk to me. A kernel bug will affect all the running virtual machines. In other words, you only need to break one kernel and you have them all.

    Plus you can't run different operating systems on each virtual machine.

    It does have some positive benefits, it all really depends on what you are doing. I like the security of Xen and VMware better though.

    --
    The ratio of people to cake is too big
    1. Re:OS virtualization by ovz_kir · · Score: 1

      Speaking of security, every major hosting service provider is using Virtuozzo, selling cheap VPSs (virtual environments) with root access for like $15/month, so every evil hacker out there can buy one and try to exploit the box. They can't -- otherwise all those HSPs will be in big trouble.

      Why they can't -- because OpenVZ/Virtuozzo security is on a good level. We do care about security a lot.

      Speaking of VMware and Xen -- there is still a single point of failure in those solutions -- VMWare itself and host OS in case of VMWare, and hypervisor and Dom0 in case of Xen. So, it is neither better nor worse in theory.

      In practice, though, security is good when people do care about it. For obvious reasons (a lot of customers in HSP world) Virtuozzo (and OpenVZ) does care for security. But don't take my word for that -- go try it out, download and install OpenVZ, expose a few virtual environments to the outside world, give their passwords to everybody and see if they can break your system. Why not?

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    2. Re:OS virtualization by Anonymous Coward · · Score: 0
      every major hosting service provider is using Virtuozzo
      Oh, sorry, I forgot to turn my b*llsh*t filter back on...
  11. Linode by XanC · · Score: 1

    You need to move to Linode.com, seriously. They don't have any of the problems you mention. It's all UML for now, although they have some Xen boxes in beta that you can get on.

    1. Re:Linode by subreality · · Score: 1

      And without knowing anything about what I'm doing, you make a recommendation for a service provider? My requirements are a bit more complex than that. :)

  12. Obvious question: containers by Anonymous Coward · · Score: 0

    Solaris 10 introduces the idea of "containers", which seem to me to be a very close match to what this guy's talking about. Anybody know how they compare in terms of their isolation, their performance, and so on?

    1. Re:Obvious question: containers by ovz_kir · · Score: 2, Interesting

      Very short answer -- Solaris Containers is the same technology as OpenVZ or VServer. Their isolation is OK as well, their resource management is worse than that in OpenVZ. There are some system-wide resources that you can not limit for a containter -- which can create problem if an application inside a containter goes crazy (or a container is owned by a c00l ha>

      Remember, Solaris Containers are a recent feature, while Virtuozzo was available as a product since year 2001. So, Solaris is doing the right things and great things, but it still has a way to go.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
  13. Perhaps they haven't heard, but Xen 3 is stable by cduffy · · Score: 4, Informative

    The interviewee keeps talking about Xen 3 like it's not out yet, but that's untrue.

    Indeed, Xen 3 has been stable long enough that they're presently at 3.0.2. It's not prerelease anymore, and support for x86_64 and hardware-supported virtualization has been out and about for a while. I have semi-production (used by in-house staff only, but there are folks who can't work if it's down) systems running on Xen3 x86_64 DomUs, and the host they're on has been up (and running unattended) for 117 days now.

    Sun has a OpenSolaris port to Xen (though I think it may be in-house-only still), and I have some good friends working on a microkernel OS targeted at embedded operation with a Xen DomU port pending (such that they -- and people working on it -- will be able to run it in parallel with the OS they use as their development platform). Being able to run more than one kernel -- indeed, more than one operating system -- is a big plus on the Xen side of things.

    1. Re:Perhaps they haven't heard, but Xen 3 is stable by Anonymous Coward · · Score: 0

      Xen for OpenSolaris was released back in February.

    2. Re:Perhaps they haven't heard, but Xen 3 is stable by cduffy · · Score: 1

      Xen for OpenSolaris was released back in February.

      Barely counts. No disk I/O on Xen 3, no x86_64 support, no live migration... etc. It isn't usable, so I don't consider it released.

    3. Re:Perhaps they haven't heard, but Xen 3 is stable by hritcu · · Score: 1

      I wonder what numbering scheme alowed Xen to reach version 3 so fast. Certainly not the same one used by most open source projects.

      --
      If you don't fail at least 90 percent of the time, you're not aiming high enough. (Alan Kay)
    4. Re:Perhaps they haven't heard, but Xen 3 is stable by cduffy · · Score: 1

      1.0, the first public release, was in October of 2003. 2.x, while missing some of 3.x's core features, was out and in use for quite some time. Just because you haven't heard of it until recently doesn't mean it hasn't been around.

    5. Re:Perhaps they haven't heard, but Xen 3 is stable by hritcu · · Score: 1

      1.0, the first public release, was in October of 2003

      This is exactly what I was saying. How many other open source projects you know which started numbering from 1.0? 1.0 usually comes after years of work. Consider that Linux is 2.6 after 15 years and Apache is still 2.2, while very many people are still using Linux 2.4 or Apache 1.3. At the same time Xen started with 1.0 and is 3.0 after only 3 years. Isn't this different?

      --
      If you don't fail at least 90 percent of the time, you're not aiming high enough. (Alan Kay)
    6. Re:Perhaps they haven't heard, but Xen 3 is stable by cduffy · · Score: 1
      This is exactly what I was saying. How many other open source projects you know which started numbering from 1.0?

      Any of them which started as in-house projects and thus began public life already outside of alpha- or beta-level status. That happens from time to time, and doing an initial public release as 1.0 is generally accepted practice under such circumstances (unless enough parts required changes before they could be released publicly to put the proposed release back into pre-release status).

      Consider that Linux is 2.6 after 15 years and Apache is still 2.2, while very many people are still using Linux 2.4 or Apache 1.3. At the same time Xen started with 1.0 and is 3.0 after only 3 years. Isn't this different?

      From Linux and Apache, sure -- but that's a pretty small selection of projects. Taking a wider look at small, non-mission-critical but actively-developed projects off of SourceForge might establish a wider base for comparison. (You mention folks using older versions of Linux and Apache; there are, by the way, still quite a lot of folks using Xen 2.x).

  14. Re:It's hot...it's coming...and you are left wonde by MarkTina · · Score: 2, Informative

    You know that Virtualisation has been around longer than I've been alive .. it came from the mainframe world and "discovered" by the x86 crowd :-)

  15. Nah never catch on ... by MarkTina · · Score: 1

    All those mainframes running your banks wouldn't dream of using virtualisation ;-)

  16. Re:I'm not convinced... - DON"T BE MYOPIC by jsailor · · Score: 2, Insightful

    Virtualization is HUGE. It helps solve a major problem. With few exceptions, most data centers are running out of power, not space. Servers consume 70-90% of their power draw when the CPU(s) is(are) at idle - and most servers in corporate America run below 15% utilization. If I can combine 4-8 servers into 1, I can save a tremendous amount of power. Here's some simple math.
    A server consumes 400 W at idle and 500 W when all 4 processors are pegged at 100% utilization. If I take 4 servers that normally run at 10% utilization and combine them onto 1 server that runs and 40-50% utilization, I've saved 1100 W (4 x 400W - 500W). This is a huge value proposition for anyone who manages a data center.

    I can rant forever, but trust me - this is no fad. There is a serious value proposition here.

  17. Imagine ... by 3dr · · Score: 2, Funny

    ... a beowulf cluster of virtualization servers running beowulf clusters of VPSes!

    1. Re:Imagine ... by smoker2 · · Score: 1
      Imagine a beowulf cluster of virtualization servers running beowulf clusters of VPSes!
      .... with each server having an 8 way mainboard containing 2 core chips pretending to be a single core chips ....

      Imagine playing solitaire on that !

  18. Not Really by zeketp · · Score: 1

    I see myself using virtualization to run Windows inside Mac OS X. Don't like Xcode? It happens to be built on top of the most commonly used compiler, GCC. It is just a front end to replace using terminal based text editors and prevents you from needing to remember all the options needed to run GCC from the command line. I'd say that if any OS dies out, it will be Windows first. If people can dual boot/virtualize Windows on Macs, the biggest obstacle in the way of mass Mac adoption is gone. I'm confident that once people get Macs and play around in OS X (it's inevitable) then many will start switching to OS X for everyday use. Developers think they can just switch to Windows? Not likely when it gradually becomes considered a burden to swap to Windows, and suddenly Mac compatibility becomes a feature! I think it is far easier to write an Objective C/Cocoa Framework app (including all the necessary under the hood work in addition to a GUI) than it is to write a Windows application with a GUI. Just want to tie good old C++ into a GUI? Xcode already can do, or you could just compile it to run on the command line. Want to use a command line editor and GCC? Already there. Want to compile for Linux and Windows? Look at GNU Step and related open source implementations of Cocoa. C/C++ is the foundation for Objective C, so you can jump right in after a basic tutorial on objects and message passing. I don't see linux going anywhere, maybe gaining ground as Windows boxes suddenly become obsolete because of new mac switchers or Vista's (and successor's) large jump in system requirements. Given the trend among my friends (all of us college students, tomorrow's leaders, etc.) then Mac market share is looking at a sharp increase in the near future. Heck, I'm in aerospace engineering, and I'm writing this from a Powerbook G4, when many small, home brewed applications I encounter require Windows. But you know what? No small home brewed app is more than a match for Virtual PC. Any app that is something important enough to pay for has a Mac version or equivalent.

    --
    Last Post!
  19. Virtualization success by tallsails · · Score: 2, Insightful

    Its amazing how low utilization of servers is. Developers love lots of servers, but don't use them nearly as much as they say... see article "Virtualization is the COOLEST thing" at http://blog.tallsails.com/

  20. Xen misconceptions by jforest1 · · Score: 3, Informative

    Just to clarify: "Using Xen, you need to specify in advance the amount of memory for each virtual machine and create disk device and filesystem for it, and your abilities to change settings later on the fly are very limited." Xen supports a balloon driver that can allows for one to add or take away from the memory allocated to guest operating systems (DomU's). It is highly advised to us LVM2 to allocate disk space for DomUs, since it allows for easy changes to the partition. This makes file system management easier. "But most importantly, OpenVZ has the ability to access files and start from the host system programs inside VPS. It means that a damaged VPS (having lost network access or unbootable) can be easily repaired from the host system, and that a lot of operations related to management, configuring or software upgrade inside VPSs can be easily scripted and executed from the host system. In short, managing Xen virtual machines is like managing separate servers, but managing a group of VPSs on one computer is more like managing a single multi-user server." Using LVM2 as the disk manager as mentioned above, the host operating system (Dom0) can access the DomU's filesystem for troubleshooting and run programs (though it would not be run in the scope of the DomU, I'm not sure that he's actually implying that is the case with OpenVZ). --josh

    1. Re:Xen misconceptions by jlittle · · Score: 2, Informative

      Regarding running applications within the scope of a VE (DomU equivalent), yes he is. I extensively use both Virtuozzo and Xen. Each has their strengths. VZ allows efficient use of memory (shared memory across all VMs) as well as disk space, as binaries _can_ be shared with a copy on write file system. You can do a lot of this in Xen, but you can't mount a Xen domU filesystem in Dom0 when a DomU is using it. In OpenVZ, the filesystem is only mounted in the hardware node and exposed through an FS layer (copy-on-write) to the child VZs. Regardless of the state of the VM, you can enter into its state w/ a shell similar to a chroot. But you can fully execute commands from the hardware nodes context into the VZ context. The line separating the two is a process in OpenVZ. In Xen, its a full OS instance with private memory spaces. Its a double edged sword, but it has saved my ass in a few cases with OpenVZ.

    2. Re:Xen misconceptions by jamesh · · Score: 1

      but you can't mount a Xen domU filesystem in Dom0 when a DomU is using it

      Can and do :). Use OCFS2, piece of cake to set up and the because Xen 3.0.2 is based on 2.6.16, it's already in the kernel tree.

      Haven't used it as the root filesystem yet (just as a shared filesystem between domains), but when I do I will (in theory) be able to have 1 filesystem with 'per node symlinks' (ocfs2 calls them something else but that's what they are) so each node/domain can have a separate /etc, /var/run, /var/spool, and so on.

    3. Re:Xen misconceptions by Anonymous Coward · · Score: 1, Informative

      Using stuff like vservers (or openvz) is much simpler than xen. Sure with xen, you can mount the lvm volume to access file, but you can't do that while the virtual machine is running, unless you want to corrupt the file system in the volume. With vserver, you can do it since this is the same kernel.

      Virtual machine like xen are useful, but vservers are much more useful. I mean, you really should look at vservers on any server you use, since the performance is the same (as a normal server). I have around 40 vservers on my notebook for various projects.

      Stop thinking about virtualisation for hosting solution or major mega servers. virtualisation solves real world every day problems

      -Project separation so you can update one without breaking the othe
      -moving projects around. You develop on your workstation and move to production server as is later.
      -clone a vserver and perform an update on the copy. If successful, turn off the original. Turn it back on
        when you realize you have a problem :-)

    4. Re:Xen misconceptions by demon · · Score: 1

      You can also use GFS, or one of the other clustered filesystems to do this, though what I'm really waiting to see is XenFS - as far as I know it's still in the works, and it'll definitely put an interesting new spin on Xen virtual machines.

      --

      Sam: "That was needlessly cryptic."
      Max: "I'd be peeing my pants if I wore any!"
    5. Re:Xen misconceptions by Bert64 · · Score: 1

      That's just chrooting, any serious unix user has been setting up chroot environments for years for many different purposes, i too have several chroot environments on my laptop...

      The reason for virtualization is to solve different problems:
      true isolation between nodes (with vservers other users can often bind to your ips etc)
      resource limitation
      ability to run differently-configured kernels, or even different operating systems

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    6. Re:Xen misconceptions by ovz_kir · · Score: 1

      Well you might call it chrooting, but it is very advanced chrooting. No, even not like jail, much more advanced than that. Just read the article (and probably OpenVZ docs, too), or try it for yourself to see the difference.

      > true isolation between nodes (with vservers other users can often bind to your ips etc)
      No, in OpenVZ VPS you can not bind to somebody else's IP -- virtualized network is one of the differences between Linux-VServer and OpenVZ. Seriously, consider reading the interview itself -- it is mentioned there as well.

      > resource limitation
      Resource limiting, or, I'd rather call it resource management, because it is not just the limits but also the guarantees -- another big part of OpenVZ.

      > ability to run differently-configured kernels, or even different operating systems
      Indeed this is what OpenVZ or any other OS-level virtualization solution can not do, naturally. Still, I can not consider that requirement as a requisite condition for the technology to be called "virtualization".

      --
      -- Kir Kolyshkin, OpenVZ project leader.
  21. Yep... by msauve · · Score: 0, Flamebait
    and if someone really want to slow their servers down by running multiples on one processer, they can just buy a bunch of $20 486's on eBay instead, and get better reliability (a h/w failure only takes down 1 server instead of many).

    What's the difference between having a virus/worm/rootkit/zombie infection on a virtual server vs. a real one? You still need to rebuild/restore to recover.

    I suppose it's useful for an individual who wants to run multiple OSes, and easily/quickly switch between them, but that's a very small Slashdot/geek thing (which is of course why the article appears here).

    --
    "National Security is the chief cause of national insecurity." - Celine's First Law
    1. Re:Yep... by Anonymous Coward · · Score: 4, Informative

      A virtual server can be restored in seconds, no rebuild required. A virtual server can be moved to another host server in seconds without ever shutting down. A virtual server has a common hardware configuration and can be moved to another host with completely different physical hardware in seconds without shutting down (you can mix Dell and HP servers for example and switch between them on the fly). Not every virtual server needs dual Xeon processors and 8GB of memory, but a bunch of virtual servers can run on that machine and share load as required and if one of those virtual machines needs a little extra umph for some biweekly processing, it has the ability to grab more resources or the other virtual servers can be moved off to another physical server hosting virtual servers with more power without ever shutting it off [1]. Redundancy in the virtualization world requires two physical host servers each able to carry the load of all the virtual servers and a shared disk area (SAN, iSCSI). To have that level of redundancy in the plain of non virtual world, each server would have to have a second physical server for backup and unless you were clustering, you would not have the ability to move over your processes to the backup physical without some type of interuption if one of them suddenly failed like in your example.

      Virtualization has many advantages in the enterprise and the ability to recover from a virus in your example is one small part of the whole package.

      [1] Host servers can share memory between virtual servers, not just the total memory but the memory between machines as well. Very simple example but if you open sol.exe on one of the virtual servers, you will not take up any more total memory on the host machine by opening sol.exe on another virtual server on that same host. The memory is shared between the running virtuals as well. This works great when you have quite a few of the same OS being virtualized on a host. You could run 10 plain vanilia virtual copies of Windows server 2003 and the total memory taken up on the host will be less then 1.5 times more then a single running copy of that OS, not 10x of a single virtual. That example of 10 exact copies is not likely in real life but the common memory is shared which can make up for a significant amount of total memory savings.

      Don't let your lack of insight or knowledge of the capabilities of virtualization get in the way of your opinions ;)

    2. Re:Yep... by alfarid · · Score: 1

      I would like to point out that energy efficiency goes down, and in our times of energy wars, mc*c is the most dreaded thing. So virtualisation is meant to become the energy compliant thing. but, i'm with you on slashdot/geek thing.. only until Oracle and IBM will acquire some market players. hmm.. maybe they should buy VMWare :)

    3. Re:Yep... by Anarke_Incarnate · · Score: 1

      Very interesting points. My company is moving towards virtual servers (not MS Virtual Server) for some of those very reasons. Right now, if a server fails we need to either reinstall the OS and restore from backup tape or replace the failed hardware.

      In the new senario, any one server failure will simply result in the VMs being down for moments (we're not paying for the expensive up all the time jazz, hard enough to get the money for this project).

      When it is time to upgrade, we simply roll in faster hardware and move the VMs over to it. If we want to test upgrades to the guest OSes, we can simply take a snapshot of the LUN it is on, test, and if we like it, fully populate it to the SAN. If we don't, we roll it back and no harm done.

    4. Re:Yep... by iceburg · · Score: 1

      EMC already bought VMWare...

      --
      Prudence | Justice | Fortitude | Temperance
    5. Re:Yep... by Cus · · Score: 2, Interesting

      I fully concur with the parent - I'm helping with an ESX environment at the moment that's running on 8 Proliant blades. Each of these will end up with on average 8 Virtual machines on each one and that leaves us with a lot of overhead 'just in case'. As well as redundancy it's physically taking up a lot less space and power. Regarding redundancy, we're running with storage on a SAN - if the error detection system uncovers an imminent failure in the hardware (or if we decide to), the time taken to transfer a virtual machine onto another server doesn't take long at all - after all, you're only looking at shifting the memory, not the drive contents. It *is* weird seing a fully function copy of W2k3 running SQL Server only taking up less than 100 MB RAM, though :)

    6. Re:Yep... by agony_zhou · · Score: 1

      How about, err, just run all the applications on the same box if you really want to consolidate them? You know, a (well designed) application can be moved with minimal disrruption as well?
      The only point I can see is for proprietary softwares that have really annoying requirements and do not play well with others. For well designed free softwares virtualization does not give you much.

    7. Re:Yep... by Anonymous Coward · · Score: 0

      Let me know how that goes after you reboot your one server that is your SQL, DHCP, document management server, your smtp scanner, and running your server managment software that happens to be also running your BES and antivirus management and your accounting and HR apps as well. Better call all those departments first before you reboot it though.

      Your all eggs in one basket plan makes no sense regardless of what OS and applications you are running. I guess your theory is if something is going to break, it might as well be everything at once.

    8. Re:Yep... by ovz_kir · · Score: 1

      If you run all the apps on the same box you gonna have problems. Here are just a few.

      System-wide resources. There are some system-wide resources like the number of open files, number of sockets, IPC shared memory pages, physical memory pages, virtual memory pages, swap, number of processes etc. etc. Basically, any app can go mad and abuse one of those resources, rendering the whole system (and all the other apps) unusable. This is the most serious problem I believe. You can limit some of the resources -- like disk space, using per-user and per-group disk quotas -- but you can not control all of them. In contrast, in OpenVZ each VPS has a set of resource limits (and guarantees) and a VPS owner can not eat the whole box (unless configured to do so).

      Users, libraries, distros. Different apps like different environments -- for example, app A requres library B version C. Not every application can run on every distro -- we have to face the truth. This is not a serious problem usually, but it arises sometimes. In OpenVZ you can have different sets of libs, different distros in different VPSs.

      Security. Intruder hacked your old sendmail and got a local user. At the very least, he can now see the other processes and files. In some worse scenario he might find yet another hole and have a root user -- and all your apps are now had.

      There are some other things like that as well. To conclude, virtual environment gives you the needed level of isolation between apps. Besides that, there are some added benefits -- like you can migrate your VE to another box without restarting your application(s)...

      --
      -- Kir Kolyshkin, OpenVZ project leader.
  22. virtualisation by Tinkster · · Score: 2, Informative

    ... and then there's the outstanding IBM p-Series machines with their Hypervisor in
    hardware that benefits from the aforementioned age-old mainframe technology :}

  23. Yeah, but... by countach · · Score: 1

    I don't doubt that OS-level virtualization is more efficient, but have you ever tried upgrading the OS for hundreds of applications at the same time? It's darned near impossible.

    The great benefit of hardware level virtualization is that you can upgrade one app and one environment at a time. If app-"A" needs Linux 2.4 because that is what Oracle supports - fine, no problem. But if app-"B" needs to upgrade to Linux 2.6 because its reporting suite must have that version, that is ok too.

    It seems to me that OS-level virtualization is a cool sounding idea that is pretty hopeless in the real world.

    1. Re:Yeah, but... by BlueLightning · · Score: 1

      It seems to me that OS-level virtualization is a cool sounding idea that is pretty hopeless in the real world.

      It depends on the application. If you're talking about a web host running lots of web servers it might make sense to use this approach, since the guest systems are likely to be very similar if not the same.

    2. Re:Yeah, but... by countach · · Score: 1

      I guess if you think hard enough you'll think of a good application for it... but in the case of web server farms, what's the point of having multiple virtual environments unless you are going to open them up to your clients to install their own PHP or postgresql or mysql or whatever darned bit of web technology they want? If all you want is a bunch of web sites on virtual hosts, you can just use the apache virtual hosts function. But if you want to give clients a free for all, you basically have a massive headache to upgrade the OS later on.

    3. Re:Yeah, but... by Artichoke · · Score: 1

      We use VServer to provide semi-managed environments where we look after the main apps such as apache, postgres, mysql, php etc. in /usr and /opt, and our customers can install whatever else in to /usr/local. Works well with gradual introduction and deprecation of app versions, though it takes some .spec mods to get several versions of some apps to live happily side-by-side :)

      --
      __
      Arse
  24. Just what we need -- more kernel bloat by Anonymous Coward · · Score: 0, Troll

    I'll tell you one thing -- I would like to see a lot less stuff "merged into the mainline Linux kernel." It's seldom done so that I can cleanly leave out the features I really don't need/want, and I always end up paying the overhead.

    1. Re:Just what we need -- more kernel bloat by ovz_kir · · Score: 1

      We surely do understand that.

      All of the OpenVZ aspects and features (like User Beancounters) can be turned on or off in kernel .config. I.e. OpenVZ kernel can be compiled without (or with) any of OpenVZ features.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
  25. Very one-sided by A+Nun+Must+Cow+Herd · · Score: 1

    As you would expect from such an interview, it ignores the advantages of products like VMWare Server which make them attractive over Virtuozzo (and OpenVZ). Hardware virtualization allows the guests to be independent of both host hardware and host OS. To us that alone is worth the trade-off in performance, and giving up the resource management that Virtuozzo has. With the enhanced support for virtualization in hardware (e.g. the new Intel and AMD CPUs) I expect that the performance difference between hardware and OS virtualization software will decrease, but the other advantages of hardware virtualization will remain. There must also be advantages in security and upgrade-management that come with being less dependent on the OS... ?

    1. Re:Very one-sided by ovz_kir · · Score: 1

      How VMWare can be independent of host OS if it runs on top of it? I mean there is a single point of failure here: if host OS dies every VMWare instance dies with it.

      And the question is not just performance -- indeed, with hardware band-aids like AMD Pacifica and Intel VT performance will be better. The question is density, scalability, and manageability (it is funny you even mentioned it -- see below).

      Density: you can run hundreds of virtual environments in OpenVZ, you can run tens of guests in VMWare. Makes sense?

      Scalability: can VMWare effectively utilize "big hardware" like 64-way SMP box with 64 GB of RAM? OpenVZ can -- absolutely no problem, there are no additional SMP hacks needed etc. More to say, a single virtual environment can use all those resources if needed.

      Manageability: From a sysadmin point of view, VMWare guest is just like a physical server. If you want to apply software updates, you have to log in into each one and run an update procedure. One by one, the very same way you'd do it with separate physical boxes. In contrast, in OpenVZ you can actually see and access all the virtual environments from the host OS, making mass-management possible. You can apply updates en masse. You can do mass-management. Makes sense?

      Indeed, VMWare (or other solutions of the kind, like Parallels or QEmu) makes sense if you want to run different operating systems, different kernels etc. It makes much sense in development labs, at home or when you have just one server. But if you have a rack of servers -- OpenVZ/Virtuozzo/other solutions of the kind makes much more sense, due to the reasons cited above -- scalability, density, manageability.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    2. Re:Very one-sided by Malor · · Score: 1

      Hardware virtualization is not a 'bandaid'. In fact, it's the only proper way to do it. Software virtualization is the band-aid.

      I suspect you're going the wrong way; with the hardware support in VT and Pacifica, Xen and VMWare are going to get a lot faster. It won't be that hard for them to add in features like what you have (particularly for Xen, which is integrated in the Linux kernel), but it will be very hard for you to do what they're doing.

      Specialized hardware support is always faster than general-purpose software. While it may not be all the way there yet in the first generation of hardware, ultimately, solutions that take advantage of hardware to do virtualization will run faster and be much more secure than any software-level solution.

      While what you're doing is very useful in the short run, I think you will eventually need to adapt to the hardware model, or die.

    3. Re:Very one-sided by ovz_kir · · Score: 1

      Hardware virtualization support (like VT/Pacifica) is not a panacea -- first it is just a beginning, many things are not implemented, and many things are implemented, well, in a suboptimal fashion. Say, a context switch between a guest OS and a hypervisor requires as much as 2000 CPU cycles in Intel CPU (and it's not better with AMD, if you ask). So you want to avoid that and modify a guest OS to do things without a need to jump to hypervisor. Speaking of security, again, there is no silver bullet. Security is better than you care for it, as we do care (and VMWare does care, although they had some security issues in the past (with bridged network adapter AFAIR) -- which proves my point it is not more secure in theory). Back to hardware-aided virtualization, I didn't say we can not use VT or the future technologies from hardware vendors. Actually we do have a few VT-enabled boxes in our labs and will be using their features in future versions of Virtuozzo/OpenVZ.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    4. Re:Very one-sided by ovz_kir · · Score: 1

      Speaking of technologies, you just can not achieve a level of density which you have in OpenVZ (VServer, Solaris Zones, etc.) with either Xen or VMWare. Running multiple kernels is indeed a strange idea -- kernel is designed to be run on top of hardware; kernel is a piece of software to be used between hardware and application software. This is what Linux does, this is what Windows kernel does, this is what OpenVZ does. If you run kernel on top of something else (VMware virtual machine, Xen hypervisor) you are gonna have problems. Let me give you just a couple of examples. Say, each kernel caches the stuff read from (written to) disk. How can you unify that caching process if you are having multiple kernels? I do not say impossible, I say extremely tricky. Disabling cache is not an option - your performance will drop. Say, you want to give more memory to your virtual server. In case of OpenVZ, this is just a single "vzctl set" command, no problems, you just raise the limits the same way you do for disk quota. But how can you explain the kernel running inside a VMWare or Xen what it can use more memory now? I do not say impossible, I say extremely tricky. And there are a lot of dirty dirty hacks needs to be done to fix such stuff.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    5. Re:Very one-sided by cduffy · · Score: 1

      I suspect you're going the wrong way; with the hardware support in VT and Pacifica, Xen and VMWare are going to get a lot faster.

      VMware gets faster. Xen gets a mode in which it acts more like VMware (can run unmodified operating systems), but is slower than otherwise on account of needing to virtualize drivers rather than having a guest modified to pass requests in an optimal manner. OpenVZ still wins for performance, while Xen wins for flexibility.

    6. Re:Very one-sided by A+Nun+Must+Cow+Herd · · Score: 1
      Manageability: From a sysadmin point of view, VMWare guest is just like a physical server. If you want to apply software updates, you have to log in into each one and run an update procedure. One by one, the very same way you'd do it with separate physical boxes. In contrast, in OpenVZ you can actually see and access all the virtual environments from the host OS, making mass-management possible. You can apply updates en masse. You can do mass-management. Makes sense?

      Good point, and that's a nice advantage of OpenVZ/Virtuozzo running lots of little servers. However any tools that an organisation has for working with multiple physical machines will work just as well with virtual machines under VMWare.
      When I said independent of OS I meant that the virtual machine could be run under VMWare on a Windows or Linux host. In an organisation primarily running Windows but still using other OSs that's pretty important, and there are lots of uses for that kind of thing (such as software testing). I still think VMWare can be used in a wider range of applications, despite OpenVZ being able to run lots of virtual machines on one physical machine.
      As far as increased complexity of VMWare's approach you're absolutely right, but they've done it and done it well.
  26. "Virtualization" - in a sense by ratboy666 · · Score: 2, Informative

    These are not virtual machines. The idea seems to be the same idea behind Solaris 10 Containers, and I wish that had been discussed (pros and cons) in the interview.

    Easier management for vertical stacking of applications on a machine.

    And, yes, it is VERY useful.

    Not for typical home use though. At home, I use VMWare for virtualization, QEMU to run foreign code, and BOCHS to test x86 assembly sequences, all of which I do frequently. Stacking? Not so much, because my main server is a dual PPRO with 128MB -- httpd, imapd, file services, time services, etc. Not a heavy load (104 processes, easy enough to manage manually).

    Ratboy.

    --
    Just another "Cubible(sic) Joe" 2 17 3061
  27. FreeBSD Jails by Ragica · · Score: 2, Interesting
    Sounds, once again, a lot like FreeBSD's jail support (which has existed for many years now, and is very stable).

    In what ways is OpenVZ different? I also wonder what their "commercial offering" adds... but i'm too lazy to look.

    I run FreeBSD jails on my box for testing purposes. It's extremely easy to setup and administer, especially with many helper scripts available these days.

    I am loving the simplicity of ezjail. The coolest thing about it (besides the utter simplicity), is that it creates a "base jail" containing an entire FreeBSD install. From there it uses tricks with nullfs to mount parts of that base iinto jail 'instances'... this means each new jail takes only 2 megs of additional space, and about 1 second to create. It also adds security in that the base system remains absolutely read-only, while still permitting customisation and additional software to be installed in the jail.

    I need a new virtual server to test my software:

    ezjail-admin create new-jail-name 192.168.5.123

    Then run the ezjail startup script. And SSH in to my new virtual server. (Note: i set up the default server template to enable SSH and a few default logins... very easy to do. One does not need to use SSH; one can get into the jail environment a few different ways.)

    1. Re:FreeBSD Jails by Anonymous Coward · · Score: 0

      that's not really different from how Linux-VServer does it:
      in this case hard links are used to 'unify' the 'jails',
      effectively reducing a new guest to only a few megabytes,
      and the tools support similar install methods, by either
      copying existing guests or installing them from network.

      maybe one important difference the linux variants add
      compared to BSD jails, is the resource management and the
      better isolation (e.g. for IPC)

    2. Re:FreeBSD Jails by Anonymous Coward · · Score: 0

      > maybe one important difference the linux variants add
      > compared to BSD jails ....

      the MAIN difference is: FreeBSD jail(8) is not a patch set against some development kernel.
      it has been around for some time.

  28. Indeed! by babbling · · Score: 1, Offtopic

    That's true, but come on, it's going to be pretty fun to play with on desktop machines, too, isn't it? Imagine all the tricks you can play on computer-illiterate friends/family. One second it's Windows, the next it's MacOSX, then 10 seconds later it's Linux! Heads may explode.

    1. Re:Indeed! by somersault · · Score: 2, Funny

      get a KVM switch =p

      --
      which is totally what she said
  29. History again repeats itself.. by Anonymous Coward · · Score: 5, Informative

    In the mid 60's IBM created CP-67 which virtualized the IBM S/360. In the following years the system became VM/370, and has evolved to z/VM today http://www.vm.ibm.com/. VM (the general term for z/VM) is made up of two primary components, VM/CP (control program) and VM/CMS (a mini single user operating system). VM/CMS provided the ground work for being able to administer the system, and provided a nice programming environment in that each VM/CMS user had their own "system" that one could edit, compile and run their programs in an interactive environment (think of a MS-DOS type of model -- then remember that this was in the late 60's).

    CMS itself provided some limited simulation of IBM's two other mainframe operating systems OS/360 and DOS. Enough that one could write simple OS or DOS programs and do at least some unit testing. The simulation by CMS was by providing a limited set of the OS and DOS API.

    Unlike MVS or DOS, (or even the CP/M, Windows, or *nix families) VM/CP itself does not provide many services directly. VM/CP does not provide any filesystems, any application APIs, etc. All VM/CP really did was to provide a barebone virtual machine and only provide those services one would find on the bare hardware. It was the responsibilty of the operating system running within the virtual machine to provide the application API, filesystems, application memory management, etc. Communication between vm's were originally only via the raw hardware model (channel-to-channel adapters, shared disk volumes, and a method of "punching" virtual cards and sending the virtual cards to another vm's virtual card reader.) As time progressed, VM/CP did provide some API's that allowed very simple messaging between two vm's (first VMCF - Virtual Machine Communication Facility, and then IUCV - Inter User Communication Vehicle).

    Early on it was "discovered" that the virtual machine model made a lot of sense as a method to implement VM services. For example if one were to look at a modern VM system, you would see that the entire native VM TCP/IP stack is managed within a small collection of vm's. (Under VM/CP, a vm is called a "userid"). The native VM TCP/IP stack consists of a TCPIP userid that manages the network interface devices, and the TELNET server. The FTP userid implements the FTP protocol, etc. Each userid is totally seperate from the rest of the system and from each other (the tcp/ip socket facility "rides" on top of IUCV in a transparent fashion so that a tcp/ip server is coded the same as on *nix).

    Because of the facilities provided by CMS, it is fairly easy to write little servers. For example the orginal LISTSERV server http://www.lsoft.com/products/listserv-history.asp / was written as a CMS application. As well as several native VM webservers.

    If one wants to see what is and has been possible in a virtual machine environment, one should at least look at the history of IBM's VM.

    For an excellent history of VM http://www.princeton.edu/~melinda/
    and the VMSHARE archive, an early BBS used by VM system adminshttp://vm.marist.edu/~vmshare/

  30. Could someone explain briefly what it is? by maillemaker · · Score: 1

    Thanks for the post, it gives me some insight into what virtualization is. But I'm still confused about what it actually does. I read this entry over on wikipedia:

    http://en.wikipedia.org/wiki/Virtualization

    Does virtualization basically run multiple OSes on one box? Make one computer appear to be 2, or 3, or n?

    Steve

    --
    A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
    1. Re:Could someone explain briefly what it is? by NitsujTPU · · Score: 1

      In the very simplest case, there is a program called a virtual machine monitor that multiplexes the underlying hardware. Operating systems that run atop this see the hardware as if they have exclusive access to it.

      The cool part comes in what one chooses to do with this. See, now the operating system sets on something that in its simplest sense does this... but one can build more interesting things into the VMM that allow it to do things like snapshot the entire running operating system and move it across a network.

      If one abstracts things in certain ways, then you get certain, rather amazing abilities. You could build a really beefed up VMM that looks like a full micro-kernel OS. This would give you very strong separation of services, making the isolated OS's very resilient to attacks on other OS services. Picture a system in which you have a database and a webserver running on one box, the webserver has a buffer overflow exploit, a malfeasant individual sees this and exploits it, hoping to nail your database... the database runs on the same physical machine, but is not succeptable to this attack, because its operating system remains unaffected, but you didn't need two machines.

  31. Virtualization is the future by microbee · · Score: 2, Insightful

    And it's coming. But I think VMWare and Xen got it right. OpenVZ tries to do it inside the OS, which makes OS too much more complicated. It's not going to scale.

    1. Re:Virtualization is the future by Forbman · · Score: 1

      Well, CoLinux works pretty good under Windows, better than Cygwin for sure. The only hitch is getting networking set up. The CoLinux wiki is a bad mashup of WinXP information. At one point I got it to work fine on a work computer under Windows 2000, but I tried the same at home (again, Win2K), and the colinux side does not connect to the net... *:(

    2. Re:Virtualization is the future by Anonymous Coward · · Score: 0

      Just note, that OpenVZ virtualization patch is smaller than any incremental Linux mainstream kernel update for minor version.
      So it can be argued that it is complicated.
      Scale? I suppose you are wrong as well. it scales as good as original linux kernel. can you run 100VMs on 1Gb RAM with VM technologies? I doubt :)

    3. Re:Virtualization is the future by ovz_kir · · Score: 1

      Not sure what do you mean by the term "scale". I can imagine the same phrase being said about a multiuser (or multitask) operating system: "that concept that system has multiple users (processes) makes OS too much more complicated". Well, you know that all this multi* stuff is a reality, and the next step in OS evolution is multiple virtual environments. Think of it for a minute.

      Indeed, this is what guys like IBM did on a big million dollar mainframes. And this is what now possible to do on your laptop. And it makes sense.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    4. Re:Virtualization is the future by microbee · · Score: 1

      Scale as in "complexity". A VM level virtualization perfectly separates the two layers of software. On the other hand, building virtualization inside OS itself means that everything needs to be touched to be properly virtualized. VMWare used to do full-virtualization, which means the VM could run any OS unmodified. It has some performance issues, and Xen's paravirtualization gets a fine balance, that is to have a minimal set of modification of the guest OS. Now these companies are trying to propose a Virtual Machine Interface ABIs to standardize the VM-OS interface to make the layering even easier. To me, the OpenVZ approach is a step backward.

    5. Re:Virtualization is the future by ovz_kir · · Score: 3, Interesting

      Speaking of complexity, it is indeed complex. Any OS is complex. VMWare itself is very complex. Any stuff that is not trivial is complex.

      The questions are: whether it works, and is it maintainable?

      Whether it works? OpenVZ and Virtuozzo works just fine -- ask anybody who's using it, get a cheap Virtuozzo VPS from one of the HSP, or just install it on your Linux box and see for yourself.

      Is it maintainable? OpenVZ stable kernel is based on Linux kernel 2.6.8 (with tons of backported fixes and driver updates). We have recently ported it to 2.6.15 and 2.6.16, and also to the kernels from Fedora Core 5 (here) and SUSE 10 (here). So I think it is maintaintable.

      [VMWare] has some performance issues, and Xen's paravirtualization gets a fine balance, that is to have a minimal set of modification of the guest OS.

      Hmm, isn't that Xen which requires a modified Linux kernel? Is that "a minimal set of modifications"? Are you kidding? In contrast, in OpenVZ's VE you run an unmodified Linux distribution, the only missing piece is the kernel which is provided by the host OS. There are modifications (like removing getty from /etc/inittab), but they are not strictly required.

      What's the point then? OpenVZ also runs a modified Linux kernel. Well, the point is you can not have hundreds of VMs with Xen (or VMWare), but you can -- with OpenVZ. OpenVZ is also more stable -- but Xen will cure this, I believe, so this is not the point in the long term.

      Basically, VMWare is at the one end of the scale -- can run anything, bad performance, scalability and density, OpenVZ is on the other end -- can run Linux 2.6 only, native performance, best possible scalability and density, easier management. Xen is somewhere in the middle of all this.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    6. Re:Virtualization is the future by walt-sjc · · Score: 1

      I don't get your comment at all.

      VMWare and Xen virtualize an entire machine, creating multiple virtual machines, with virtual hardware and all that mess. Openvz just virtualizes an instance of ONE machine, mainly just doing priviledge / resource separation.

      Considering that it is MUCH less complicated from a total lines of code POV and uses much fewer resources to operate, openvz seems like it would scale MUCH MUCH more. Don't get me wrong, I like VMWare a lot - been using it since 1.0... But the two products work very differently and have different applications.

      I plan on using both vmware and virtuozzo (the versions that cost $$$) because they both make sense, but for different applications and reasons.

  32. Solaris already has this-- it's called Zones by Anonymous Coward · · Score: 0

    Check it out -- download a copy of Solaris Express and give Zones a whirl. Another example of Linux playing catchup...

    1. Re:Solaris already has this-- it's called Zones by Anonymous Coward · · Score: 0

      Sorry to say that pal, but Linux is not catching up here, because projects like Linux-VServer exist for more than five years now, and solaris Zones are a very recent development ...

    2. Re:Solaris already has this-- it's called Zones by ovz_kir · · Score: 1

      Virtuozzo is in production since 2001, according to http://www.swsoft.com/en/company It is way ahead of Solaris Zones, which, by the way, still lacks proper resource management, similar to that found in OpenVZ/Virtuozzo. And why resource management is of paramount importance is described in Andrey's interview.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    3. Re:Solaris already has this-- it's called Zones by Anonymous Coward · · Score: 0

      What sort of resource management functionality are you refering to that is missing
      from Solaris Zones?

  33. Yep by XanC · · Score: 2, Informative
    That's basically the idea. A single machine can be running several different systems at once, and each one can have its own kernel, network settings, tuning for a particular task, whatever. You can set up the network however you want; you can even simulate subnets and routers and who knows what to try stuff out.

    Another big advantage is that the virtualization provides a common "hardware" layer. For example, every VMWare "machine" sees standard VMWare "hardware", no matter what kind of metal it's actually runnning on. Want to move your "server" from your Celeron desktop to a big RISC server? You don't even have to reboot it. (It'll be inaccessible while you transfer it, but there are ways around that too.)

  34. Following a well worn, but very productive, trail by karl.auerbach · · Score: 2, Interesting

    It sounds like the *nix VM world is moving along the track established by Multics and IBM's CP/67 (later VM/370) projects.

    It seems to me that the differences in the *nix approaches are mainly whether the abstract machine seen by user written code resembles a hardware machine or some nicer abstract machine.

    In all VM approaches the idea that one can freeze an entire system and look at it, or isolate it, or migrate it, is a very valuable one. It's done well for IBM on their mainframes.

    As for adding resources on the fly - way, way back (mid 1980's) Robin O'Neil and I did a System V based kernel for the Cray's out at Livermore. We had to run on top of the real OS, so we gave each user his/her own copy of Unix and create a file system that could grow or contract, adding, or removing inodes on the fly. And some of those inodes could reference files held by the underlying OS, thus making strange things, like "df" showing less space on the file system than was shown by a "du" summation of the file sizes in the file system. We published a paper on this at one of various Unix gatherings of the time.

    So if we could expand file systems on the fly 20 years ago I don't see why it should be so hard to do today.

    Now if we'd just get serious about capability architectures... (Much of the secure OS work of the '70's was done with capability architectures with hardware support such as the old Plessy machines.)

  35. Just Imagine by vga_init · · Score: 1
    Perhaps I misunderstand virtualization, but this is what came to my mind after reading about it:

    Imagine that in the future nearly every application will be run inside its own private virtual systems. This will be done to improve security, scalability, etc etc. For very complex applications, this will improve the stability of the system as a whole!

    1. Re:Just Imagine by Anonymous Coward · · Score: 0

      Yep -- take a look at the "history repeats itself" above. The IBM VM system has been doing this since the late 60's

  36. Hate to say it, but it is not true virtualization by solarappleman · · Score: 2, Insightful
    Running single instance of kernel, I run single OS yet. They can mimic all benefits of virtualization on this level, but basic security improvement I obtain is nothing more than a fancy variation of process privileges separation, achieved by cost of immense additional complexity and waste of resources.

    Basically, I would never jump into separating everything around just to make things safe, unless I look for a fancy way to mess up.

    But for sure, this tool can be very useful for some cases.

  37. Re:Hate to say it, but it is not true virtualizati by ovz_kir · · Score: 1

    I'm not quite following you. What do you mean by "true virtualization"? Emulation? First of all, "virtualization" is a broad concept, it means making something that is not real look like real. Virtuozzo and OpenVZ does just that. From a point of view of a virtual environment only, it looks pretty much like a real server (with the only exception he can not use another kernel and/or load kernel modules).

    Speaking of security, Virtuozzo is used by almost every major hosting service provider, and they sell cheap VPSs. If the level of security isolation provided by VZ is not strong enough, all those providers are screwed.

    OpenVZ has undergone a throughout security review by a leading security expert Solar Designer last year; some bugs (including a few bugs in the mainstream Linux kernel 2.6) were found and fixed (and submitted to mainstream). Of course that does not mean it is free of bugs -- so I urge you to give it a try and find it out for yourself.

    In theory the concept of OS-level virtualization is not weaker than other approaches as it comes for security. In practice, one should take a lot of care to make sure his software is secure. We at OpenVZ do care much for security, because it is a vital feature of OpenVZ (and Virtuozzo, for that matter).

    --
    -- Kir Kolyshkin, OpenVZ project leader.
  38. Just today I was looking at virtualization... by Anonymous Coward · · Score: 0

    Coincidently, I was just looking at virtualization options for Linux but for embedded devices. I came across Iquana (http://www.ertos.nicta.com.au/software/kenge/igua na-project/latest/), which I consider very interesting.

  39. Virtualization is no silver bullet by ufoot · · Score: 0

    Well, the question is, why virtualization? While it can be very usefull from my developper's point of view, getting rid of headaches installing a bazillions OSes on a single computer to test out your program with Win98, WinXP, Red Hat, Mandrake, Debian, FreeBSD, and possibly OS/X, I see little gain from my software end user's point of view.

    My primary OS is GNU/Linux, I have pretty much all the applications I want on it, and never really feel the need to use a specific, dedicated Windows application. Now *some* applications really need Windows and/or OS/X, most of them being linked to hardware. I mean, WIFI does not work on my linux-ppc laptop. Well, what would I gain with virtualization? Running OS/X on top of a Linux kernel won't help, for OS/X won't access the hardware directly, after all, that's what virtualization is about, isn't it? The other solution is to run OS/X as a primary OS and use a Linux kernel on top of it. But then, well, unless the virtualization is absolutely perfect and runs at 100% and costs 0 byte of RAM, I'll loose some performance using 99% of my applications. Not acceptable either.

    My conclusion is that while virtualization is very usefull in a corporate context, eg you want to separate environnements, ease up backups, increase security, have 10 different OSes installed on one server for testing purposes, whatever, it fails to fully replace double boot. The main reason is that the role of a kernel is not only to launch programs, but also to provide programs some form of access to the hardware. And virtualization is just about denying direct access to the hardware.

    Double/triple booting is far from disappearing...

    1. Re:Virtualization is no silver bullet by ovz_kir · · Score: 2, Informative

      Have you actually read the interview?

      OpenVZ provides a kind of virtualization called OS-level virt, or partitioning, or slicing. Basically you divide your Linux box into multiple small linux boxes, called virtual environments (VEs).

      In each VE you can have different Linux distro installed. Consider FC4, FC5, CentOS and Debian running on the same box, so you can compile and test you app in all these distros, without a need to reboot or have a dedicated boxes for each of those.

      To further understand between three different kinds of virtualization, read this small article

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    2. Re:Virtualization is no silver bullet by gbjbaanb · · Score: 1

      Have you actually read the interview?

      Welcome to Slashdot 'kir', where in Microsoft Russia, all your Portmans are gritted by joo, but you missed a interspersed diacritic mark between the conjunctive pronoun in the second sentence.

      (If you've been around a while, you'll recognise that :-)

      Personally, I think OpenVZ is fantastic - I've heard very good things about Virtuozzo, even that its worth the price, so I'm going to try it out. The only thing that concerns me is the kernel versions, I'd be far happier if a more recent version was available (eg 2.6.16) and kept more up to date. I don't know how much effort is required for this though. Good luck with getting at least parts included in the kernel.

    3. Re:Virtualization is no silver bullet by ovz_kir · · Score: 1

      Thanks!

      Speaking of "recentness", current development branch of OpenVZ kernel is 2.6.16 based (here). You can actually use it, but we can not guarantee it is as stable and matured as the current stable 2.6.8-based kernel.

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    4. Re:Virtualization is no silver bullet by ufoot · · Score: 0

      Yes, I acknowledge my precedent post was sort of topic since refering to virtualization in general and not the kind of virtualization proposed by OpenVZ, which is after all, the subject 8-) Indeed OpenVZ fits those users who want to heavily test out zillion distros and sandboxing junkies.

      Point is for most cross-distrib testing, chrooting is usually very convenient and lightweight. Not as nice as true virtualization, you still have to share ip ports and hardware and mess arround with /proc, you can't really play a true boot sequence, only try and simulate it, but to test out wether program A runs with glibc-2.2.1patchLevelXYBZ-my-special-release-nobod y-else-has, it does the job.

  40. Re:It's hot...it's coming...and you are left wonde by ovz_kir · · Score: 1

    You are damn right pal!

    The obvious difference though is x86 crowd is now doing it in software, not in hardware -- and so it's much cheaper.

    --
    -- Kir Kolyshkin, OpenVZ project leader.
  41. Re:I'm not convinced... - DON"T BE MYOPIC by shmlco · · Score: 1

    No one is going to want to run their servers at a high utilization rate as it leaves no headroom. Let one of those combined "virtual" servers get Slashdotted or mentioned in a blog or Time and you bring down the whole shooting match.

    A better way to do what you suggest would be figuring out some way to run all of those "virtual" machines/applications in a cluster so that if one gets /.'ed the load spreads out and is handled across multiple boxes. In a sense, you need to make the cluster look like a single server to the application as well as the client, so that to both it's balanced transparently.

    --
    Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
  42. Re:I'm not convinced... - DON"T BE MYOPIC by scumbaguk · · Score: 1

    that's why an essential part of any virtulization is qos.

  43. Re:I'm not convinced... - DON"T BE MYOPIC by shmlco · · Score: 1

    QOS systems won't help if your sole server is getting hammered. In fact a "fair" allocation system could quite easily make things worse by forcing allocation of time to virtual server's who're idling in comparison.

    --
    Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
  44. Virtualization is great on servers by Nurgled · · Score: 1

    We make use of virtualization at my company all the time. When we need to prototype something or even need to deploy a production server application quickly we just take one of our pre-rolled skeleton installs of either Debian or Windows Server 2003, copy it and start it up. We can then just install whatever needs to be installed and we have a new "server" up within a few minutes with no need to purchase new hardware. When a particular physical server gets too busy we can buy a new one and easily migrate a virtual machine to the new server with minimal downtime. With some of the more fancy virtualization solutions you can even transport running images between hosts with no downtime at all, though we don't make use of that here since we don't run critical services in virtual machines.

    I expect the market for server virtualization to continue to grow for some time, especially now that modern processors can do much of the work in hardware so the guest kernels can run in ring 0 and talk to real rather than emulated hardware.

    1. Re:Virtualization is great on servers by buckley · · Score: 1

      Yes, absolutely... you took the words right out of my mouth. I've used virtualized servers for various phases of a product development cycle and it *can* offer some very powerful options.
      -Buckley

  45. sex by Anonymous Coward · · Score: 0

    it's like virtual sex, it's just not the same.

  46. Hmmm.. Operating System by OneSmartFellow · · Score: 1
    or Virtualization System; please tell me the difference.

    After all if an OS can run 'under' a Virtual Server, then surely the Virtual Server is the OS, and the OS is just a collection of applications which work together to improve the experience of running other applications.....ad nauseam

    1. Re:Hmmm.. Operating System by ovz_kir · · Score: 1

      In the term "OS-level virtualization" by "OS" they mean kernel.

      So, in OpenVZ, it is kernel which provides those virtual environments, and you can have any app or any linux distro running inside that virtual environment (as long as stuff is compatible with the kernel; in OpenVZ case this requires distro which can be used on a 2.6 kernel).

      --
      -- Kir Kolyshkin, OpenVZ project leader.
  47. Correction by XanC · · Score: 1

    The big server would still need to be x86 in that scenario.

    1. Re:Correction by Anarke_Incarnate · · Score: 1

      Yes, you are correct. Think about how it would streamline development/testing. You want to try out a new feature or patch to an application. You bring a snap of your VM to your testing server. You launch your VM of the production server, make the change, and validate. When done, you snap that over to the real box and you are live. You don't have to implement the change twice. If it is trivial, not a big deal, but if it is a major issue like a multi hour recompile, this could save tons of time.

  48. Re:Hate to say it, but it is not true virtualizati by solarappleman · · Score: 1
    "What do you mean by "true virtualization"? Emulation? First of all, "virtualization" is a broad concept..."

    Here we speak of Software Virtualization and not of Virtualization in general. Software Virtualization traditionally means running an OS in emulated environment. You emulate environment for OS software only, not for its kernel. In traditional context, that could not be considered as a true OS virtualization. Of course, virtualization is still emerging field, and it is not quite correct to point out "true virtualization" or "false one". In that I agree with you.

    "Speaking of security, Virtuozzo is used by almost every major hosting service provider, and they sell cheap VPSs. If the level of security isolation provided by VZ is not strong enough, all those providers are screwed."

    Cheap emulated dedicated servers may revolutionize corresponding IT services. But that concept is not about security. For me, Virtualization is all about possibilities, not security.

    Virtualization is a very much spoken about idea, often complemented by "Let's put all our distributed services into one box" (inspired by VmWare and server blades) publicity. Some posts here were saying just that, considering OpenVZ. Or even marveled "What a great idea to put each software piece into a separate virtual machine!". OK, no problem they consolidate services such a way, if they feel to. But for what sake should they feel safer having done so?

  49. This could be Microsoft's or Apple's future by shis-ka-bob · · Score: 1
    Vista is getting out the door late, and I'll bet that most of the reason is that they have to get backward compatablity with all of the software that came before. It seems to me that An OS/X-like operating system (a clean kernel and network stack with a lovely, deeply integrated GUI) could run XP virtual machines whenever you needed to run a 'legacy' application. This would allow Microsoft (or Apple, or the OS community) to code an efficient OS and still be able to have all of the arcane hooks (e.g., duplicates of all the undocumented crap within Windows that becomes essential to some legacy application that had to use the undocumented 'feature' to avoid some other buggy API call that didn't quite work either) that are needed by the vast installed user base.

    So, you have an agile, 'open-source' like environment for rapid operating system development and you have the virtual machines that can be frozen at some point in history when the legacy application was supported.

    Luckily, Microsoft moves so slowly that I would bet that either Linux or a BSD like OS/X will be able to implement this first. This could be a future where the open-source model of development is the prefered environment. Elephants are imposing and dangerous, but they can't swim with Penguins (or Puffy the blowfish).

    --
    Think global, act loco
  50. Re:I'm not convinced... - DON"T BE MYOPIC by un1xl0ser · · Score: 1

    The only caveat to virtualization the way you are describing it is that if a system has most of it's time at 10% utilization, but peaks for a few hours pegging the CPU, and using all of the memory... you could be in a bind.

    It takes a much different set of administration skills to manage systems like these than it does lots of distributed boxen. I can't admit that I know all of the problems and issues, but there are many. I know that at my last job, we had a lot of systems that were performing very poorly (serious disk I/O and latency). This was probably due to a kernel bug, as it existed on many systems and platforms, but we never had time (or motivation) to fix the problem. The amount of knowledge and understandig to convert an environment to a virtualized one is, IMHO, non-trivial. Benefits are there, but it takes a lot of work and planning.

    --
    v4sw6PU$hw6ln6pr4F$ck 4/6$ma3+6u7LNS$w2m4l7U$i2e4+7en6a2X h
  51. UML really does have performance issues. by cduffy · · Score: 1

    I used to use UML fairly heavily, but the real-world I/O performance was awful, even with the skas patches applied on the host. Xen's a dog too right now (as far as I/O operations are concerned -- particularly video) when doing VMX domains [which use hardware-supported virtualization rather than a paravirtualization-aware guest], but on native domains the performance hit isn't nearly as bad as it is with UML. Do some I/O-heavy (rather than CPU-heavy) benchmarking, and the difference becomes fairly visible. This is particularly true on a multiprocessor box where the Xen Dom0 has a core to itself to use for driving I/O.

    (Also, Xen has had live migration for a long time now. OpenVZ will have Virtuozzo's implementation in the not-distant future, but I'm not aware of any plans to bring live migration to UML at all).

    OpenVZ, on the other hand, *does* have a design which makes it inherently better as far as performance is concerned. It's not nearly as flexible as Xen (in terms of being able to mix guests' kernels and operating systems), but from the design I'd expect that I/O overhead would be practically nonexistant. UML was a damn cool piece of hackery in its day, and still has practical uses -- but as a server virtualization tool, there are getting to be tools out better suited to the job.

  52. Exactly Why Virtualization is Good by Target+Practice · · Score: 2, Interesting

    "Well, the question is, why virtualization?"
    "virtualization is very usefull in a corporate context, eg you want to separate environnements, ease up backups, increase security, have 10 different OSes installed on one server for testing purposes"

    You really answered your own question, which is something to respect in the slashdot halls, where an empty question is more common...

    To add my own thoughts, though, I'd say that's exactly why I want virtualization, and why I'd rather have it at the hardware level than anywhere else. If I could test out what the latest patch from my software vendor will do (whose patches have a tendency to crap out their system) in an entirely simulated environment, I would love it.

    While I'm preparing for implementing a new and improved way of doing things, such as authenticating against LDAP instead of locally on each of my ten servers, it's reassuring to my higher ups to see the process actually implemented in a test environment, with ten servers, and working. Something tangeable for them to try out always sells better than "I think we can do this, I read about it, but I haven't tried it out yet."

    Running in a production environment may be something of a different beast. I'll probably wait a year for others to test the waters before I jump on board, but I AM anxious to do so.

    It was great to see the latest (I think) AMD hardware running Suse 10 with its Xen installation (So, Linux base) with an unmodified Windows XP OS on top. Sweet stuff. I'll never use it. But it indicates I'll be able to install any version of Linux, without kernel modification, and use it for my daily test needs. As soon as I can remember what the underlying hardware was, that's going on my list of 'toys to buy'.

    Sorry to jump on your bandwagon, but I had to say it somehow...

    --
    There's a 68.71% chance you're right.
  53. There is a performance cost by Maximilio · · Score: 1
    The emulation isn't free. Having multiple machines jockeying for the same resources (disk spindles, memory, whatever's scarcest) can slow things down, even if you plan for the worst. And remember that once people understand what VMware does, they tend to think of it as a bottomless bag and just keep stuffing crap into it until the bottom breaks out.

    At the most I'd use VMware for something that's highly controlled (like your test lab example) or non-resource-intensive. I don't think it's ready for full virtualization though. I can clearly tell the difference between running a process off a VM box and running it off a "real" box.

    1. Re:There is a performance cost by ovz_kir · · Score: 1

      OS-level virtualization approach (like OpenVZ) is not adding much overhead per se. So in case of proper planning it will work out right. Speaking of proper planning, OpenVZ has a sophisticated resource management capabilities in kernel (and Virtuozzo provides GUI tools to manage that, among the other things). There exist a set of per-VE limits and guarantees (and guarantees are met in case you do not oversell).

      --
      -- Kir Kolyshkin, OpenVZ project leader.
    2. Re:There is a performance cost by NitsujTPU · · Score: 1

      Resource contention is an issue even if you intend to merely run multiple applications under a single operating system. I do feel, however, that the benefits of the use of VMMs far outweigh the costs (which, in some cases, are quite minimal, consider the honeynet I mentioned, they used paravirtualization techniques and copy-on-write to minimize memory consumption. The equivalent hardware would have been impossible to assemble.)

      Even as such, most of the really exciting technologies that are being brought in with all of this have been floating around in systems research for a good while now, and are now just being realized through small, simple, well-written VMMs.

  54. Re:Hate to say it, but it is not true virtualizati by Anonymous Coward · · Score: 0

    Grand Master Astroturfer. Fuck off please. XEN is all we need.

  55. This is so 1995 by Sigg3.net · · Score: 1

    This is so 1995.
    They had this way back then, you can see it when Razor and Blade contact their affiliates and they take that Gibson down. The blocks turn red when they're hacked.
    It comes with sound fx.

  56. MULTIX? by RecycledElectrons · · Score: 1

    Their system sounds like what MULTIX was supposed to be, before we gave up and switched over to UNIX.

    Andy Out!

  57. Re:Following a well worn, but very productive, tra by SEE · · Score: 1

    It sounds like the *nix VM world is moving along the track established by . . . IBM's CP/67 (later VM/370) projects.

    Of course, Linux on zSeries is already out, stable, and effective for S/390 and later zSeries hardware, and plays very nicely with z/VM. The tricky part is doing the same thing on x86 boxes (given the instructiuon set noncompliance with Popek-Goldberg), which is why there are so many projects going at it from so many different angles.

  58. Re:Following a well worn, but very productive, tra by grigori · · Score: 1
    "In all VM approaches the idea that one can freeze an entire system and look at it, or isolate it, or migrate it, is a very valuable one. It's done well for IBM on their mainframes."

    Mostly right, but mainframe VM doesn't have the ability to migrate a virtual machine. Nor does it have a balloon technique to manage pressure on memory, as VMware does. Rumor is that is being worked on

  59. via envy24, cirrus logic cs4630... by Ayanami+Rei · · Score: 1

    All good sound DSPs (arguably better than anything from Creative quality-wise), and they all support 8+ hardware mixed sound streams.
    As a bonus the envy24 has very flexible hardware mixing and routing too... so you could actually have 4 different OSs running with 4 different stereo output pairs on the same card (check the Midiman 1010 for an example of the requisite hardware incantation for 8 mono outputs).

    --
    THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
    1. Re:via envy24, cirrus logic cs4630... by Anonymous Coward · · Score: 0

      Well, thanks for the information on those cards much more relevant than the X-fi, but in real world scenarios where music and sound effects are starting and stopping in real time at the same time, many cards have problems 'dealing' with them at the same time(but deal with them 'eventually'), the X-fi has 4 subprocessors, (similiar to the way modern GPUs have 'pixel pipeline' counts) so at least for gaming, the X-fi potentially* allows sound effects to be left on in games, where leaving them on is normally a 'competitive' disadvantage.

  60. It's the economics (tempted to say ", stupid") by TheLoneGundam · · Score: 1

    It's the economics of the thing: if you are paying money for your server-class hardware, you should be using between 90 and 99% of the box, or you're wasting money. But, you say, it's so HARD to run a server at 90%, and my SMTP service barfs all over my SQL database, or it corrupts memory by being poorly written, so I run those on separate boxes. Virtualization allows you to use separate "boxes" while still running the hardware as flat out as you can.

    Two reasons it came about in the mainframe world first: 1) those boxes were originially horrendously expensive (now they're just "merely" expensive) and so you definitely didn't want to buy more than one or two; and B) the IBM 360 architecture, from which the current z/series has evolved, was designed and engineered from the ground up for multi-user, multi-tasking environments, with later evolutions added for multi-processor envuronments. Things like storage protect keys on each hardware page of storage help to kill those applications that don't play nice with others, rather than killing your system.

    If you haven't looked into it yet, look into Linux (especially SuSE) on 390x architecture, running on z/VM as the virtualization hypervisor. It runs your favorite Linux stuff, runs Apache, and you can get Mono for it too if you need to handle the .NET stuff as well. Depending on your z/box size, you can scale to hundreds of virtual servers making it potentially useful for a hosting environment as well.

    Not to mention that most virus binaries won't run on this architecture.

    See the Linux VM group. Although their web page is sometimes a little out of date, the mailing list isn't.

  61. Wow, very cool... by maillemaker · · Score: 1

    So basically, what has happened, I gather, is that computers have gotten so powerful that now we can split up one "hardware unit" (a PC) into serveral virtual units, with different levels of connection (or none at all) between these virtual units.

    I think this is an awesome way to run a web browser - just destroy the virtual machine every time you are done browsing and you greatly minimize infection possibilities.

    Steve

    --
    A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
  62. Re:I'm not convinced... - DON"T BE MYOPIC by Anonymous Coward · · Score: 0

    A server consumes 400 W at idle and 500 W when all 4 processors are pegged at 100% utilization.

    Or you can simply get a server that uses less power. e.g., Sun's new "CoolThreads" servers have a 300W power supply.

  63. Errr, no. by Ayanami+Rei · · Score: 1

    The only advantage that the X-fi system gives you is the ability to mix in surround and do environemntal processing and filtering in hardware.

    Starting and stopping sounds, music and straight matrix mixing them is computationally simple and does not require anything resembling "pipelines" or multiple chips or any of that bullshit. It requires a decent DMA implementation and relatively low-end MAC-capable DSP to get uber-channels. What the envy24 and crystal-sound lines have going for them especially are superior ADC/DAC paths and the support for more analog input and output channels.

    Really the games can mix down the sounds in realtime easy. Its just that most games don't do jack shit in terms of preloading the environmental effects into memory, so that the first time they're used, you get a disk-hit... or god forbid they use some kind of basic synthesis. The sound engine design is always an afterthought, and it shows.

    But yeah, turn off EAX. Its retarded.
    And if you must have accelerated surround sound with wall reflections and crap, try a Terratec DMX (envy24 + EAX acceleration DSP) or maybe a Hercules GameSurround III (cs46xx + vortex engine)

    --
    THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
  64. Speaking of reboot... by ovz_kir · · Score: 1

    Using OpenVZ or Virtuozzo, you can live migrate all your Virtual Environments (VEs) to another physical server before rebooting your box. "Live migrate" here means no need to reboot VEs, means no existing network connection will be broken etc. etc. After you've done your maintenance on the physical server (be it adding more RAM, or kernel upgrade, or switching from one distro to another -- you just migrate your VEs back. Also note that if another server has different NIC or SCSI controller -- you don't have to worry. This (ability to do live migration and be independent of hardware) is just one little piece of functionality that OS-level virtualization provides.

    --
    -- Kir Kolyshkin, OpenVZ project leader.