VirtualBox Development At a Standstill

jones_supa writes: Phoronix notes how it has been a long time since last hearing of any major innovations or improvements to VirtualBox, the virtual machine software managed by Oracle. This comes while VMware is improving its products on all platforms, and KVM, Xen, Virt-Manager, and related Linux virtualization technologies continue to advance as well. Is there any hope left for a revitalized VirtualBox? It has been said that there are only four paid developers left on the VirtualBox team at the company, which is not enough manpower to significantly advance such a complex piece of software. The v4.3 series has been receiving some maintenance updates during the last two years, but that's about it.

Comments

Does It Matter?

[Anonymous Coward]

Legitimate question. I like VirtualBox and have used it for a long time, but as the summary said there are good alternatives available which are improving. As far as I know the only real "killer" feature of virtualBox is its OpenGL acceleration, and we'll probably see that in KVM and friends soon enough. Besides that, VirtualBox basically does what it's supposed to do at this point. Even if it stands still, it'll still be useful for awhile (I know I find no compelling reason to switch right now).

Are there some other core VirtualBox features I'm not aware of that keep people pinned to it? If not, I say let it stagnate and eventually be replaced.

Re:Does It Matter?

[TWX]

I only use vbox for local VMs, like when I need to emulate a Windows machine on my Linux box for some Windows-only software that I have to deal with from time to time. I'm not the VM guy at work, but there are lots of virtualized servers running headless on some big blade systems, does vbox do that or is that pretty much out of its scope?

I agree, for basic workstation stuff it works fine as-is.

Re:Does It Matter?

[kschendel]

I use VirtualBox to host linux and winders VM's on a Mac laptop. It's free, and my other alternatives aren't. All I care about is whether it works, and I'm not all that interested in graphics acceleration and the like. So I hope it sticks around, even if it "stagnates".

Re:Does It Matter?

[CodeReign]

I have vbox running a few hobby servers using its headless mode. But I do this from familiarity and a need for a user friendly cross platform service.

That said it's not a business worthy endeavor as its headless functionality is solid but there are 0 management tools that work WELL with it (phpvirualbox is fine but there are few bugs that cause major issues).

Oracle does have some of its own tools but if you're willing to pay oracle costs you are willing to pay VMWare costs too.

Re:Does It Matter?

[thedbp]

VirtualBox does have a headless mode, which is how I use it. Combine it with phpVirtualBox for a web-based front-end and you can admin from anywhere or any system.

Autostart, autosave, auto-snapshot, etc can be achieved with simple startup and cron scripts.

Re:Does It Matter?

[rwa2]

For basic workstation stuff it's fine.

It's also pretty heavily used for development and test of server deploys. A lot of DevOps types are trying to use VirtualBox to build disposable test clusters for their applications, and has been the default and one of the best supported engines for vagrant.

Unfortunately, a lot of app footprints are starting to rely on deploying other "appliance VMs" in your VM (yo dawg), and VirtualBox is still straggling behind the others on implementing some form of nested VM capability. https://www.virtualbox.org/tic... So it's kinda getting to a point of having a large and growing number of server apps that you won't be able to use VirtualBox to set up a local development and test environment for things that involve, say, using a Stackato PAAS, or a FEO appliance, or an Apigee API gateway appliance, etc. to pick a bunch of essential pieces from recent memory. At least not without a lot of work to host those VMs directly on VirtualBox and not looking or working at all like they would when they hit production.

Re:Does It Matter?

[jythie]

There is something to be said for 'fine as is'. Changes can cause bugs, changes can cause incompatibilities, changes can require updating skills to understand their impact or how configuration has been altered. When all you need is a tool for completing a task without heavy requirements, stable and predictable can be a real selling point.

One of the reasons I like VirtualBox is it changes so little. I have to worry very little about having to look up new things when all I need is a quick drop in solution for something small. Every time I go back to KVM I feel like I have to go find out 'ok, so how does it work NOW?' and then make sure I find documentation and forums talking about the KVM version in relation to the distribution and its version I am using.

Re:Does It Matter?

[MachineShedFred]

Parallels really kinda sucks. Of the three major hypervisors available for OS X, it's the worst of them and that's with VirtualBox being stagnant for a year+. No support for OVAs whatsoever. If you virtualize OS X, you can't use keyboard shortcuts without the hypervisor thinking that Cmd+Q was meant for it, rather than an app in the guest OS. And yes, it doesn't do very nice things with thermal management on your hardware.

VMware Fusion works pretty good, but costs $. VirtualBox, for a time, was actually better than VMware Fusion and free. The guys at VMware have fixed that though.

Re:Does It Matter?

[BillAtHRST]

It would certainly be nice if they fixed the performance of shared folders. That would make it much more practical to run multiple VM's on a single machine. See http://mitchellh.com/comparing... for some interesting info. I tried this myself, and it's true -- read performance on shared folders is many times slower than virtual disks, making them fairly useless.

Oracle ...

[Anonymous Coward]

Where software goes to die

Re:Oracle ...

[Anonymous Coward]

Oracle is busy converting VirtualBox to run in Java.

4 paid developers yes, but

[Anonymous Coward]

are you unaware that the majority of it is open source? Therefore there's far more than 4 people looking at the code

Re: 4 paid developers yes, but

[allquixotic]

This is a little story about four people named Everybody, Somebody, Anybody, and Nobody.
There was an important job to be done and Everybody was sure that Somebody would do it.
Anybody could have done it, but Nobody did it.
Somebody got angry about that because it was Everybody's job.
Everybody thought that Anybody could do it, but Nobody realized that Everybody wouldn't do it.
It ended up that Everybody blamed Somebody when Nobody did what Anybody could have done.

Basically, there needs to be a team of people (whether volunteers, paid employees, or a mix) who are dedicated to spending a specific number of hours explicitly assigned to working on security testing of a piece of software, and then have those hours held accountable. Meaning, if they have no results over a long period of time, or aren't putting in the hours, even if they're just volunteering, then their position on the team should be vacated for someone else willing to do the work.

Features are completely different, and most types of non-security bugs are also different. In general, people implement features because they find it genuinely fun to do so. Also, as long as the software has users, the absence of a feature will not normally cause millions of dollars in damage, loss of reputation, or identity theft. The consequence of the absence of a feature is usually annoyance or inconvenience, but is upper bounded by what that feature would provide if available, rather than being upper bounded by the limits of human cruelty and deviousness, which are MUCH higher bounds than even the most major features.

This is why it's OK to let features develop "organically" in a bazaar fashion. Even bugs can be developed this way: if nobody is encountering the bug, who cares if it's there? And bugs that are encountered frequently will get complained about and/or fixed directly by the core devs or a drive-by patch. Security, on the other hand, almost requires a deliberate, cathedral model to provide any guarantees.

Bringing small aspects of cathedral development philosophy -- the best parts of the cathedral only -- into projects that were once purely "bazaar-only" projects like OpenSSL, can only be a good thing.

If it ain't broke...

[gabereiser]

don't fix it. I mean sure I'd like more features and stuff, but it works out of the box. No tweaking (other than to guest vm's) or anything necessary. It just works. Sure there are other (paid) alternatives out there but VirtualBox does it's job well for me.

Re:If it ain't broke...

[ihtoit]

that will be the point where I'll look for an alternative. As for right now, Virtualbox will, for me:

  - boot a native MS-DOS 6.22 image (forget DOSBOX, if you want DOS functionality use fucking DOS!).
  - boot a native Win32 image with complete Win16 compatibility - just like you got in Win9x. Oh hell, I use win9x when I want that kind of functionality. Virtualbox lets me do that.
  - do the above headless and feed a thin client or six, simultaneously, off a commodity desktop system.
  - let you export a disk image to a partition mounted via the host and thereafter, boot said exported image on a completely different piece of hardware with no further hacking required. I'm looking at you, DOSBOX.
  - let you merge snapshots from specified thin clients into the service image while the image is in use.
  - connect one remote session to another remote session from another server and directly collaborate between the two, migrating clipboard and keyboard events as you go, seamlessly between two completely different desktop environments as if you were hosting them both on the local system. Comes in handy on the odd occasion I'm moving bits of user data (eg user lists) between WAMP stacks that for some reason *have* to reside on the system partition and not the segregated data partition.

This is no surprise...

[petergriffinismyhero]

Who in their right mind would willingly submit to anything from Oracle? Have you ever been audited by them? Horrible company. They have some great products, but the company itself is a nasty evil entity that thinking people avoid like the plague unless they have absolutely no other choice.

Re:This is no surprise...

[dissy]

The core virtualbox is open source and free, but the guest tools extension pack is closed and commercial. Under restrictive use cases you are allowed to install the guest tools for personal use for yourself and not need to pay for a license. But even so much as installing it for someone else is a license violation and Oracle expects you to pay for that.

No guest tools extensions means you have no drivers for the guest VM, no shared folders, no mouse/window integration, no accelerated 2d or 3d graphics nor resolutions over 1024x768 vesa.

Whom ever installs the guest tools extension is the ONLY person legally allowed to run that copy of virtualbox afterwards (following the legal agreement when you downloaded it at least.)
If you install virtualbox and the guest extensions on a PC for your mom, mom isn't licensed to run it and Oracle wants a paid license in that case.
Installing virtualbox via scripts including the guest extensions requires a license for each install, even if you are the one using a copy.
(Academic use is somewhat excluded last I saw, but not being in academia I don't know any of those details)

There is an open source version of the guest tools, at least for Linux guests (maybe others by now.)
I'm not sure what features it lacks or differences in the drivers, but they are made by a different development team unrelated to sun/oracle.

False story

[Anonymous Coward]

After looking at the release history, I don't see any changes in frequency of releases / updates.
https://www.virtualbox.org/pipermail/vbox-announce/

Add in test builds available showing future bits...
https://www.virtualbox.org/wiki/Testbuilds

Since Oracle spreads it's virtualization bits between products, talking about only VirtualBox paints an incomplete picture.

VirtualBox is akin to VMWare Workstation.
OVM SPARC / x64 is akin to VMWare vSphere (or whatever name they've selected this week).

VirtualBox coupled with kernel-zones and OVM (LDOMs) baked into the SPARC hardware and OVM for x86/x64 platforms - the entire gamut is covered.

Sorry, but Phoronix did not paint a complete picture. How much did they get from EMC for spreading FUD?

VirtualBox has been excellent, but needs QA

[DigitAl56K]

I user VirtualBox all day every day for fairly complex tasks, and it has performed admirably, yet it is sorely in need of QA help. Major releases happen with auto-update notifications and then you realize that your old snapshots can't be started, using a debugger blows up the VM, sometimes snapshots don't save properly even though it looks like they did, etc. etc. Then you have to dig out the last working version, which came out 6 months back, to get up and running again.

Aside from this "upgrade gamble", which I put squarely on a lack of beta releases, VirtualBox is fantastic. Hardware accelerated graphics with full Aero support, fast virtualization, shared clipboard and files, attaching USB devices - it's everything you need in a friendly UI that anyone can work with.

It'll be a tragedy IMO if it's left to rot.

For anyone interested, I find the last stable version to be 4.3.12 (on Windows).

Re:VMWare is worth the money

[jedidiah]

VMware has better USB and SATA device support. It requires less resources to run multiple VMs (compared to virtualbox) and more readily supports virtual clusters.

Although I could certainly see how most other desktop VM users would be perfectly satisfied with Virtualbox.

Not at a standstill, just no major features

[tlhIngan]

Funny enough, Oracle updated Vbox with a new release just 2 weeks ago. That doesn't say "standstill" to be, but more "stable and fixing bugs".

Yeah, so what if they're not making big new feature requests? They're still supporting it with updates and bug fixes, and that's a sign of a mature stable product.

Re:VMWare is worth the money

[Em Adespoton]

Same question from me -- VirtualBox is the basis for many niche solutions, such as http://www.cuckoosandbox.org/. The command-line toolset is great, and better than I've found for other similar products; you can easily do offline analysis of product runs, easily automate running test suites across multiple OSes, create a virtual network of VBox guests, and much more. VMWare does some of this, but is really aimed ad virtualized servers and desktops, not at testing and analysis. KVM could work, but is still maturing and hasn't quire reached the same level yet -- plus, it's nowhere near as portable to any host.

I also like that VBox inherits any improvements made in QEmu.

It moves...

[Doc Hopper]

Disclaimer: The views expressed in this post are my own and do not necessarily reflect the views of Oracle.

TL;DR: I am an Oracle employee. It's an awesome place to work with above market pay, superb benefits, and a demanding but rewarding engineering culture. Virtualbox is one project in a large and growing virtualization team, creating and improving some truly amazing cutting-edge technologies that make your virtualization life better.

I'm going to share some facts as I see them, and let you draw your own conclusions instead of drawing them for you.

1. The Oracle VM and Oracle VM Virtualbox teams are one and the same within Oracle. There's a lot of cross-pollination of ideas and effort, and the virtualization team is frakking huge: HUNDREDS of developers. Not "4", as some have asserted here!
2. There's a ton of stuff happening in virtualization at Oracle: https://blogs.oracle.com/virtu...
3. There's a substantial line-up of products that are demo'd to customers as part of "Virtualbox Appliances". Virtualbox demos are a key strategy for introducing many of our products to customers. http://www.oracle.com/technetw... .
Corrollary: I manage a lot of ZFS appliances. I like them; they make my job easier, particularly at the kind of scale at which one begins measuring one's storage in exabytes. You should download the Virtualbox-based Oracle ZFS Storage Simulator and check it out. Hint: Dig into the REST interfaces and ECMAscript workflows concepts. This kind of thing is Stored Procedures for enterprise-grade storage appliances with absolutely blistering scale, reliability, and performance, and if you don't yet understand how powerful that idea is, you might be insufficiently experienced in high-end storage and databases.
4. Wim Coekaerts is a smart, friendly, and communicative dude. He also happens to be SVP over our Linux & Virtualization efforts. If you're really interested in the details of virtualization development at Oracle, you should check out his blog: https://blogs.oracle.com/wim/

Next, my opinions. No longer facts!

VirtualBox is a mature, stable product that's doing its job and -- as a GPL project -- seems to me like more a vehicle for showcasing Oracle technology than a revenue generator in its own right. That doesn't mean development has ceased! It just means that, in general, Oracle engineering teams are laser-focused on how we can make money so we can stay employed so we can keep creating really unique and useful products for our customers. Responsibilities on teams shift as need demands, and with such an enormous knowledge base in virtualization on our Engineering staff, there's no question that if a product needs a feature to benefit customers, and a good case can be made that it'll pay off, it gets the engineering resources it needs to give it a try.

The Sun transition was tough for some employees. In advance of the merger, a lot of old-timers split. A lot of younger engineers went looking for somewhere hipper and younger to work than what would become a Fortune 500 company. Many Sun managers, sensing the change in the wind as Oracle's intensely results-oriented management team integrated with them, split for positions elsewhere.

I know and work with the survivors of the merger every day. And overwhelmingly, those who've integrated into Oracle culture, shown they belong here through their productivity and attitude, and produce results consistently have built success upon success, and are valued and rewarded.

They're also a bunch of brainiacs who routinely blow my mind with deep insights into operating systems, hardware, and performance optimization.

Those who don't deal well with rapid change, high expectations, and a dogged focu