Your browser does not fully support modern features. Please upgrade for a smoother experience.
Submitted Successfully!
Thank you for your contribution! You can also upload a video entry or images related to this topic. For video creation, please contact our Academic Video Service.
Version Summary Created by Modification Content Size Created at Operation
1 handwiki Vivi Li -- 1190 2022-10-20 01:39:33

Video Upload Options

We provide professional Academic Video Service to translate complex research into visually appealing presentations. Would you like to try it?
No, upload directly Yes
Cite
If you have any further questions, please contact Encyclopedia Editorial Office.
HandWiki. OS-Level Virtualisation. Encyclopedia. Available online: https://encyclopedia.pub/entry/30302 (accessed on 22 October 2026).
HandWiki. OS-Level Virtualisation. Encyclopedia. Available at: https://encyclopedia.pub/entry/30302. Accessed October 22, 2026.
HandWiki. "OS-Level Virtualisation" Encyclopedia, https://encyclopedia.pub/entry/30302 (accessed October 22, 2026).
HandWiki. (2022, October 20). OS-Level Virtualisation. In Encyclopedia. https://encyclopedia.pub/entry/30302
HandWiki. "OS-Level Virtualisation." Encyclopedia. Web. 20 October, 2022.

OS-Level Virtualisation

Edit
The content is sourced from: https://handwiki.org/wiki/OS-level_virtualisation

OS-level virtualization refers to an operating system paradigm in which the kernel allows the existence of multiple isolated user-space instances. Such instances, called containers (Solaris, Docker), Zones (Solaris), virtual private servers (OpenVZ), partitions, virtual environments (VEs), virtual kernel (DragonFly BSD) or jails (FreeBSD jail or chroot jail), may look like real computers from the point of view of programs running in them. A computer program running on an ordinary operating system can see all resources (connected devices, files and folders, network shares, CPU power, quantifiable hardware capabilities) of that computer. However, programs running inside of a container can only see the container's contents and devices assigned to the container. On Unix-like operating systems, this feature can be seen as an advanced implementation of the standard chroot mechanism, which changes the apparent root folder for the current running process and its children. In addition to isolation mechanisms, the kernel often provides resource-management features to limit the impact of one container's activities on other containers. The term "container," while most popularly referring to OS-level virtualization systems, is sometimes ambiguously used to refer to fuller virtual machine environments operating in varying degrees of concert with the host OS, e.g. Microsoft's "Hyper-V Containers."

virtual machine virtual environments virtualization

References

  1. Korff, Yanek; Hope, Paco; Potter, Bruce (2005). Mastering FreeBSD and OpenBSD Security. O'Reilly Series. O'Reilly Media, Inc.. p. 59. ISBN 0596006268. https://books.google.com/books?id=gqKwaHmXp4YC&pg=PA59. 
  2. "System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones, Chapter 16: Introduction to Solaris Zones". Oracle Corporation. 2010. http://docs.oracle.com/cd/E19044-01/sol.containers/817-1592/zones.intro-1/index.html. Retrieved 2014-09-02. 
  3. "System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones, Chapter 31: About Branded Zones and the Linux Branded Zone". Oracle Corporation. 2010. http://docs.oracle.com/cd/E19044-01/sol.containers/817-1592/gchhy/index.html. Retrieved 2014-09-02. 
  4. Bryan Cantrill (2014-09-28). "The dream is alive! Running Linux containers on an illumos kernel". http://www.slideshare.net/bcantrill/illumos-lx. Retrieved 2014-10-10. 
  5. Root user can easily escape from chroot. Chroot was never supposed to be used as a security mechanism.[6]
  6. "Docker drops LXC as default execution environment". InfoQ. http://www.infoq.com/news/2014/03/docker_0_9. 
  7. "Docker comes to FreeBSD". https://www.freebsdnews.com/2015/07/09/docker-freebsd/. 
  8. "Get started with Docker for Windows". Docker. https://docs.docker.com/docker-for-windows/. 
  9. "Get started with Docker for Mac". https://docs.docker.com/docker-for-mac/. 
  10. Utilizing the CFQ scheduler, there is a separate queue per guest.
  11. Networking is based on isolation, not virtualization.
  12. A total of 14 user capabilities are considered safe within a container. The rest may cannot be granted to processes within that container without allowing that process to potentially interfere with things outside that container.[11]
  13. Graber, Stéphane (1 January 2014). "LXC 1.0: Security features [6/10"]. https://www.stgraber.org/2014/01/01/lxc-1-0-security-features/. Retrieved 12 February 2014. "LXC now has support for user namespaces. [...] LXC is no longer running as root so even if an attacker manages to escape the container, he’d find himself having the privileges of a regular user on the host" 
  14. Disk quotas per container are possible when using separate partitions for each container with the help of LVM, or when the underlying host filesystem is btrfs, in which case btrfs subvolumes are automatically used.
  15. I/O rate limiting is supported when using Btrfs.
  16. ""Sylabs brings Singularity containers into commercial HPC"". https://www.top500.org/news/sylabs-brings-singularity-containers-into-commercial-hpc/. 
  17. ""SIF — Containing Your Containers"". https://www.sylabs.io/2018/03/sif-containing-your-containers/. 
  18. ""Singularity: Scientific containers for mobility of compute"". http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0177459. 
  19. Bronnikov, Sergey. "Comparison on OpenVZ wiki page". OpenVZ. https://wiki.openvz.org/Comparison. Retrieved 28 December 2018. 
  20. Available since Linux kernel 2.6.18-028stable021. Implementation is based on CFQ disk I/O scheduler, but it is a two-level schema, so I/O priority is not per-process, but rather per-container.[17]
  21. Each container can have its own IP addresses, firewall rules, routing tables and so on. Three different networking schemes are possible: route-based, bridge-based, and assigning a real network device (NIC) to a container.
  22. Docker containers can run inside OpenVZ containers.[18]
  23. Each container may have root access without possibly affecting other containers.[19]
  24. "Initial public prerelease of Virtuozzo (named ASPcomplete at that time)". http://www.paul.sladen.org/vserver/aspcomplete/2000-08-25/ve-0.4.2-for-2.4.0-test6.diff.gz. 
  25. Available since version 4.0, January 2008.
  26. Docker containers can run inside Virtuozzo containers.[21]
  27. Yes with illumos[22]
  28. See OpenSolaris Network Virtualization and Resource Control for more details.
  29. Network Virtualization and Resource Control (Crossbow) FAQ http://www.opensolaris.org/os/project/crossbow/faq/
  30. "Managing Network Virtualization and Network Resources in Oracle® Solaris 11.2". http://docs.oracle.com/cd/E36784_01/html/E36813/index.html. 
  31. Only when top level is a KVM zone (illumos) or a kz zone (Oracle).
  32. Starting in Solaris 11.3 Beta, Solaris Kernel Zones may use live migration.
  33. Cold migration (shutdown-move-restart) is implemented.
  34. Non-global zones are restricted so they may not affect other zones via a capability-limiting approach. The global zone may administer the non-global zones.[25]
  35. "Contain your enthusiasm - Part Two: Jails, Zones, OpenVZ, and LXC". http://www.cybera.ca/news-and-events/tech-radar/contain-your-enthusiasm-part-two-jails-zones-openvz-and-lxc/. "Jails were first introduced in FreeBSD 4.0 in 2000" 
  36. Check the "allow.quotas" option and the "Jails and File Systems" section on the FreeBSD jail man page for details. http://www.freebsd.org/cgi/man.cgi?query%3Djail&sektion%3D8
  37. "Hierarchical_Resource_Limits - FreeBSD Wiki". Wiki.freebsd.org. 2012-10-27. http://wiki.freebsd.org/Hierarchical_Resource_Limits. Retrieved 2014-01-15. 
  38. "Implementing a Clonable Network Stack in the FreeBSD Kernel". usenix.org. 2003-06-13. http://static.usenix.org/publications/library/proceedings/usenix03/tech/freenix03/full_papers/zec/zec.pdf. 
  39. "VPS for FreeBSD". http://www.7he.at/freebsd/vps/. Retrieved 2016-02-20. 
  40. "[Announcement VPS // OS Virtualization // alpha release"]. https://forums.freebsd.org/threads/34284/. Retrieved 2016-02-20. 
  41. "3.5. Limiting your program's environment". Freebsd.org. http://www.freebsd.org/doc/en/books/developers-handbook/secure-chroot.html. Retrieved 2014-01-15. 
  42. "vkd(4) — Virtual Kernel Disc". DragonFly BSD. http://mdoc.su/d/vkd.4. ""treats the disk image as copy-on-write."" 
  43. Sascha Wildner (2007-01-08). "vkernel, vcd, vkd, vke — virtual kernel architecture". DragonFly Miscellaneous Information Manual. DragonFly BSD. http://bxr.su/d/share/man/man7/vkernel.7. 
  44. "vke(4) — Virtual Kernel Ethernet". DragonFly BSD. http://mdoc.su/d/vke.4. 
  45. Available since TL 02.[35]
  46. Live Application Mobility in AIX 6.1 http://www.ibm.com/developerworks/aix/library/au-aix61mobility/?ca=dgr-btw77liveappmobile61&S_TACT=105AGX59&S_CMP=GR
  47. https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html#--property=
  48. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/resource_management_guide/sec-modifying_control_groups
  49. Polvi, Alex. "CoreOS is building a container runtime, rkt". https://coreos.com/blog/rocket.html. Retrieved 12 March 2019. 
More
©Text is available under the terms and conditions of the Creative Commons-Attribution ShareAlike (CC BY-SA) license; additional terms may apply. By using this site, you agree to the Terms and Conditions and Privacy Policy.
Upload a video for this entry
Information
Subjects: Others
Contributor MDPI registered users' name will be linked to their SciProfiles pages. To register with us, please refer to https://encyclopedia.pub/register :
HandWiki
View Times: 1.8K
Entry Collection: HandWiki
Revision: 1 time (View History)
Update Date: 20 Oct 2022
Table of Contents
    Notice
    You are not a member of the advisory board for this topic. If you want to update advisory board member profile, please contact office@encyclopedia.pub.
    OK
    Confirm
    Only members of the Encyclopedia advisory board for this topic are allowed to note entries. Would you like to become an advisory board member of the Encyclopedia?
    Yes
    No
    ${ textCharacter }/${ maxCharacter }
    Submit
    Cancel
    There is no comment~
    ${ textCharacter }/${ maxCharacter }
    Submit
    Cancel
    ${ selectedItem.replyTextCharacter }/${ selectedItem.replyMaxCharacter }
    Submit
    Cancel
    Confirm
    Are you sure to Delete?
    Yes No
    Write an Entry
    Feedback