| |||||||||||||
OpenVZ is doing fine as well ;)OpenVZ is doing fine as well ;)Posted Dec 6, 2005 19:00 UTC (Tue) by kolyshkin (subscriber, #34342)In reply to: Linux VServer Project is doing just fine now by micah Parent article: The first stable OpenVZ release Let me comment on these claims.
- stability, Although this is indeed the first stable OpenVZ release, OpenVZ is essentially Virtuozzo (without its bells and whistles), and Virtuozzo for Linux is available for more than five years already.
- Debian support, Certainly you can compile OpenVZ from sources and use it on any Linux distro. And yes, we are a part of Gentoo for about two months already (with all the recent releases making their way into Gentoo in a very timely fashion). Debian is one of our goals (see roadmap), although personally I am not a Debian expert, still with some help from the Debian community we will make it. - hardware utilization, We are supporting x86 (i386), x86_64 (AMD64, EM64T) and ia64 platforms. "Supporting" here means we have enough hardware for all the three platforms, and do an extensive quality testing (functionality, performance and stress tests) and security audit on all of them. It's a pity but we can not provide the same level of support for other platforms than those three. Speaking of specific hardware, we are supporting the same set of hardware that RHEL4 does, achieving this by backporting newer drivers from mainstream, vendors and RHEL4 kernels. There is an official Virtuozzo/OpenVZ HCL. - documentation and We have an extensive 100-pages user's guide. Also all utilities has man pages, and there are some short to-the-point howtos on the site and the forum. - community support, There is a bug tracking (Bugzilla) and quite an active support forums, also we have mailing lists and IRC channel (#openvz at freenode). We also provide fee-based support for OpenVZ, done by the same excellent team who supports Virtuozzo. - security. I can definitely say our security is higher than that of vanilla kernel. We achieve that by two means: (1) sticking to older kernel and backporting all the fixes from mainstream and (2) hiring top-rated security specialists to do OpenVZ security audit.
(Log in to post comments)
OpenVZ is doing fine as well ;) Posted Dec 7, 2005 12:47 UTC (Wed) by nnnn (guest, #34393) [Link]
Are you saying that when these "top-notch security people" find new
That would be the only way for your offering to be more secure
OpenVZ is doing fine as well ;) Posted Dec 7, 2005 14:37 UTC (Wed) by kolyshkin (subscriber, #34342) [Link] First of all, we do always send fixes we have upstream, and external people who do security audit for us are also sending their relevant findings upstream.
Second, as I have already tried to explain by my first comment here, our security can indeed be better than that of vanilla kernel. We achieve this by sticking to older (=more stable) kernel and backporting all the relevant fixes from vanilla and RHEL kernels (currently there are about 200 such patches, not counting driver updates).
So, we fix bugs and security holes, but do not introduce any new ones, that _might_ be coming with newer kernels. This is essentially the same model used by Red Hat Enterprise Linux.
OpenVZ is doing fine as well ;) Posted Dec 16, 2005 18:02 UTC (Fri) by dev (guest, #34359) [Link] No, we are not hiding security fixes and participate in security@kernel.org.But as you can see both OpenVZ and vserver add additional layer inside the kernel and to some extent actually introduce a new security model. And this security model should be review/checked/thinked over. For example, when you have a kernel bug which allows 'root' user to crash your node it is usually ok, since root is a priviledges and trusted user. In OpenVZ/vserver model root is untrusted user. See the difference? Just an example...
|
|||||||||||||