Re: [vserver] Network isolation and VServer

From: Daniel Risacher <drisacher_at_gmail.com>
Date: Tue 30 Oct 2007 - 18:33:45 GMT
Message-ID: <a3ff00ac0710301133ld871be5q3f3d90eff9522cf8@mail.gmail.com>

Thanks for the thoughtful replies.

I agree with the other posters that an administation best practice would be
to run as few services as possible in the host, but I think that this is
advice that is orthogonal to how a virtual server environment should work.

In my particular situation, I had an existing server that has a lot of
services running, and wanted to add the Zimbra Collaboration Suite, which is
packaged with its own mail server, web server, etc., etc. Many of the
Zimbra services come pre-configured to talk to each other via the localhost
address, and overlap with the existing services that I was already running
on the host. I followed instructions on the web to make this work (with
some success), but was left feeling like this was the sort of de-confliction
that a virtualization solution should have been helping me avoid.

I think Daniel Hokka Zakrisson's reply below summarizes things well by
saying:

It just goes against the general Linux-VServer paradigm. As far as
possible, we do isolation by limiting the guest to a subset of the
host's resources. As such, limiting the host's ability to use the IP
addresses it wants is just not something that fits in.

The paradigm that I was expecting was that when resources are dedicated to
the guest - they stop being the "hosts" resources, except as a
pass-through. I.e. an IP address that belongs to a guest, belongs to the
GUEST, and never the host - at least from the application's perspective.

This is not a criticism of VServer - just that my expectations were
different. In hindsight, I think OpenVZ might have been a better choice for
my situation.

Dan R

On 10/24/07, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
>
> Daniel Risacher wrote:
> > My apologies in advance if this is re-opening old wounds.
> >
> > I recently set up VServer (mainly so I could run Zimbra w/ less pain)
> > and I found that the network isolation did not work the way I
> > (perhaps naively?) expected it to. (Mainly re: binding to TCP ports
> > and IPADDR_ANY.)
> >
> > I write this message to (1) determine whether my understanding of
> > VServer's functionality is correct, and possibly (2) suggest potential
> > improvements for discussion.
> >
> > How I think it DOES work
> > ------------------------
> >
> > * Host processes that bind to IPADDR_ANY can recieve connections to any
> > host or guest address
> >
> > * Guest processes that bund to IPADDR_ANY show as having been bound to
> > the guest primary IP address, but can receive connections to the
> > localhost address that come from the same guest.
>
> This is just an optimization that kicks in if your guest only has one
> address, it significantly speeds up the lookups.
>
> > * Bind attempts to IPADDR_ANY from the host will fail if a guest is
> > already listening on that port
> >
> > * Bind attempts to IPADDR_ANY from a guest will fail if the host is
> > already listening to IPADDR_ANY on that port
> >
> > * Connection attempts to "localhost" from a guest can be answered by
> > the host.
> >
> > How I think it SHOULD work
> > --------------------------
> >
> > I start from the general assumption that a virtual machine should seem
> > like an isolated, independent machine as much as possible. It seems
> > to be a desirable goal to minimize the amount of application-level
> > configuration tomfoolery that is required. Based on this...
>
> You only have to configure the host, which shouldn't really be running
> any services in the first place.
>
> > * Bind attempts to IPADDR_ANY should not fail based on something
> > happening in a different security context. I.e. Bind attempts to
> > IPADDR_ANY from the host should be able to succeed, even if a guest
> > is already listening on that port, and likewise bind attempts to
> > IPADDR_ANY from a guest should be able to succeed, even if the host
> > is already listening to IPADDR_ANY
>
> So when someone connects to it, where should they be directed? You can't
> have multiple listeners on the same IP:port pairs, when the contexts
> overlap.

If they connect to an IP that belongs to a guest, then to the guest. If
they connect to an IP that belongs to the host, then to the host.

> * Processes listening on IPADDR_ANY should receive connections to any
> > IP address that are set up for that virtual machine (be it the host
> > or a guest).
>
> The host does not have a context. How would you expect that to work?

I think this is my problem. I expected that it would.

> Questions
> > ---------
> > So, given the above discussion, here are my questions:
> >
> > Do I mis-understand or mis-state how VServer functions today?
> >
> > Is my proposed alternative functionality "better", or is there some
> > reason why today's behaviour is "better"?
>
> It just goes against the general Linux-VServer paradigm. As far as
> possible, we do isolation by limiting the guest to a subset of the
> host's resources. As such, limiting the host's ability to use the IP
> addresses it wants is just not something that fits in.
>
> > How could we implement a more robust version of network isolation?
> > Has any work been done in this area previously?
>
> I don't get what robust means in this context.
>
> > How do the other virtualization environments handle this sort of
> > thing?
>
> OpenVZ and the containers people use virtualized network stacks for the
> guests, which I consider to be too much overhead (both performance and
> configuration wise).
>
> > Thanks for the consideration,
> > Dan Risacher
>
> --
> Daniel Hokka Zakrisson
>
Received on Tue Oct 30 18:33:57 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 30 Oct 2007 - 18:34:03 GMT by hypermail 2.1.8