My apologies in advance if this is re-opening old wounds.
I recently set up VServer (mainly so I could run Zimbra w/ less pain)
and I found that the network isolation did not work the way I
(perhaps naively?) expected it to. (Mainly re: binding to TCP ports
and IPADDR_ANY.)
I write this message to (1) determine whether my understanding of
VServer's functionality is correct, and possibly (2) suggest potential
improvements for discussion.
How I think it DOES work
------------------------
* Host processes that bind to IPADDR_ANY can recieve connections to any
host or guest address
* Guest processes that bund to IPADDR_ANY show as having been bound to
the guest primary IP address, but can receive connections to the
localhost address that come from the same guest.
* Bind attempts to IPADDR_ANY from the host will fail if a guest is
already listening on that port
* Bind attempts to IPADDR_ANY from a guest will fail if the host is
already listening to IPADDR_ANY on that port
* Connection attempts to "localhost" from a guest can be answered by
the host.
How I think it SHOULD work
--------------------------
I start from the general assumption that a virtual machine should seem
like an isolated, independent machine as much as possible. It seems
to be a desirable goal to minimize the amount of application-level
configuration tomfoolery that is required. Based on this...
* Bind attempts to IPADDR_ANY should not fail based on something
happening in a different security context. I.e. Bind attempts to
IPADDR_ANY from the host should be able to succeed, even if a guest
is already listening on that port, and likewise bind attempts to
IPADDR_ANY from a guest should be able to succeed, even if the host
is already listening to IPADDR_ANY
* Processes listening on IPADDR_ANY should receive connections to any
IP address that are set up for that virtual machine (be it the host
or a guest).
Questions
---------
So, given the above discussion, here are my questions:
Do I mis-understand or mis-state how VServer functions today?
Is my proposed alternative functionality "better", or is there some
reason why today's behaviour is "better"?
How could we implement a more robust version of network isolation?
Has any work been done in this area previously?
How do the other virtualization environments handle this sort of
thing?
Thanks for the consideration,
Dan Risacher
Received on Tue Oct 23 03:46:51 2007