Virtual Hosting & Virtual Machines

(1)

Virtual Hosting & Virtual Machines

Coleman Kane

[email protected]

(2)

Virtual Hosting

Virtual Hosting Common Virt. Hosting Schemes Environment Virtual Hosting Environment Virtual Hosting (cont.) Environment Virtual Hosting (dia.) OS-Level Virtual Hosting OS-Level Virtual Hosting (cont.) OS-Level Virtual Hosting (dia.) Hypervisor Hypervisor (cont.) Hypervisor (dia.) Emulator Emulator (cont.) Emulator (dia.) Hybrid

Similar to the network partitioning schemes described

previously, there exist a menu of options that enable a

single piece of server hardware to be paritioned so as to

provide varying levels of isolation to the applications and

users served by this hardware.

(3)

Common Virt. Hosting Schemes

Virtual hosting methods to be covered:

Environment:

Apache virtual-hosting, Java VM

OS Level:

chroot, Jails, User-mode-Linux

Hypervisors:

VirtualBox, VMWare, Xen

Emulation:

Bochs, VMWare & VirtualBox under special

configuration

(4)

Environment Virtual Hosting

In Environment Virtual Hosting, virtualization of the hosted

applications are configured within the space of another

(5)

Environment Virtual Hosting (cont.)

Generally the following ground rules are true:

■

_{The administrator of the server hardware has full visibility}

and control inside the virtual environments

■

_{The virtual applications may share, privileges, storage and}

RAM, unless specifically configured not to

■

_{Virtual processes are still visible to each other on the}

server-side

■

_{The shared nature of the infrastructure is generally opaque}

to the end-user, but counter-measures must be authored

into the applications in order to ensure this remains true.

■

_{Compromising one virtual server can put all other virtual}

(6)

Environment Virtual Hosting (dia.)

(7)

OS-Level Virtual Hosting

With OS-Level virtualization, you set up independent

deployments of whole application stacks which cannot

share each others’ configurations, libraries, modules, etc.

Configuration of the virtual environments hosting these

deployments will either be configured at the supervisor OS

level, or via specialized "no return" system calls which

request that the OS isolate all future execution and child

processes.

In the case of User Mode Linux, a wholly-contained

execution environment is created to run a different Linux

kernel as a subprocess of a parent kernel, as a new

(8)

OS-Level Virtual Hosting (cont.)

Provides the following features beyond the Environment

virtual hosting

■

_{Can be rooted at a sub-path in the filesystem, restricted}

from reads/writes outside of this zone

■

_{Requires a dedicated instance of the service for each}

virtual host

■

_{Lacks dedicated allocation, still competes for system}

resources, but executes with significantly limited visibility

to other services

■

_{Individual applications need not be specially configured,}

and will be relatively isolated from one another

■

_{Networking and IPC may still be possible between isolation}

(9)

OS-Level Virtual Hosting (dia.)

Extra cost is incurred by duplicating applications which

were shared under application-level virtual hosting

(10)

Hypervisor

A hypervisor further pushes isolation logic up to the

hardware level. Requiring special hardware features, the

hypervisor can natively execute code while maintaining

lmost complete resource isolation between the instances.

With a few small exceptions, the virtual hosts will execute

as completely dedicated OS deployments, requiring

complete OS + application installation within the virtual

guest instances.

Parent OS is called "host", while the children are called

"guests".

(11)

Hypervisor (cont.)

■

_{Execute most code natively, but expose a false hardware}

representation to the "guest" OS

■

_{Selectively allocate HW devices to guests}

■

_{Dedicate resources or limit resource with fine granularity}

■

_{Abstracted hardware enables suspend, move, restore,}

close, snapshot of running guest states

(12)

Hypervisor (dia.)

(13)

Emulator

Emulators provide an environment which attempts to

implement, in software, an entire architecture. The goal is

to provide a method to execute the code in a manner which

most closely replicates the underlying system in which the

software would execute. Minimal assistance is provided by

the host operating system, and typically no kernel-level or

other supervisory hooks are required. The entire virtualized

HW & SW stacks live entirely in user-space.

(14)

Emulator (cont.)

■

_{All code is executed at the application layer}

■

_{Absolutely zero access to the host operating system}

■

_{Host can execute guest code which is incompatible with}

host architecture (PPC on x86, etc.)

■

_{100% visibility into hardware-level operations}

■

_{Very slow execution}

(15)

Emulator (dia.)

(16)

Hybrid Implementations

VirtualBox & VMWare both offer hybrid implementations

of Hypervisors and Emulators. This enables these platforms

to adapt to presence/absence of hardwrae & software

(17)