Linux-VServer is a virtual private server implementation done by adding Operating system-level virtualization capabilities to the Linux kernel. It is developed and distributed as open source software, licensed under GPL.

The project was started by Jacques Gélinas. It is now maintained by Herbert Pötzl in Austria and is not related to the Linux Virtual Server project, which implements network load balancing.

Linux-VServer is a jail mechanism in that it can be used to securely partition resources on a computer system (such as the file system, CPU time, network addresses and memory) in such a way that processes cannot mount a denial-of-service attack on anything outside their partition.

Each partition is called a security context, and the virtualized system within it is the virtual private server. A chroot-like utility for descending into security contexts is provided. The contexts themselves are robust enough to boot many Linux distributions unmodified, including Debian and Fedora Core.

Virtual private servers are commonly used in web hosting services, where they are useful for segregating customer accounts, pooling resources and containing any potential security breaches.

Linux-VServer is not included in the mainline kernel. Linux-VServer 2.0, the stable version as of September 2005, exists as a patch against the 2.6-series kernels. A patch against the 2.4-series is also provided.

Conceptually Linux-VServer is similar to the Solaris Containers (including Solaris Zones isolation technology), or FreeBSD Jail, or OpenVZ.

Advantages

• Very fast and lightweight: virtual servers share the same system call interface and do not have any emulation overhead.
• Virtual servers can share a common file system and do not have to be backed by opaque disk images. This makes it easier to back up and to pool disk space among virtual servers.
• Processes within the virtual server run as regular processes on the host system. This is somewhat more memory-efficient and I/O-efficient than whole-system emulation, which cannot return "unused" memory or share a disk cache with the host.

Disadvantages

• Requires that the host kernel be patched.
• All virtual servers share the same kernel and hence expose similar bugs and potential security holes.
• No clustering or process migration capability is included, so the host kernel and host computer is still a single point of failure for all virtual servers (similar to Xen and UML).
• Networking is not completely virtualized (yet) and virtual servers are commonly just allocated aliases of the same network interface. This prevents each virtual server from creating its own internal routing or firewalling setup.
• I/O rate limits still cannot be set on a per-virtual server basis.
• Some system calls (for example, those dealing with the real-time clock) and parts of the /proc and /sys filesystems remain unimplemented or unvirtualized. This can prevent some Linux distributions (notably, Gentoo) from booting properly inside a vserver without modifications.
• No IPv6 support

See also

• FreeVPS, an early fork of Linux-VServer

External links

• Linux-VServer site
• Official Releases
• Implementation paper
• Linux-VServer and Open Source-Supporting VPS Provider

• VServer with Asterisk
• Sample /etc/init.d/bind9 rc file that uses capabilities and security contexts to minimize the damage a cracker could do if they broke into the BIND nameserver.
• Howtoforge: Linux-Vserver on Debian Sarge by themachine, 2005-11-11

Linux-VServer | Linux-VServer