Subject: Re: [vserver] Application containers
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 10 Jun 2010 21:16:15 +0200

On Thu, Jun 10, 2010 at 11:39:14AM -0700, Nirmal Guhan wrote:
> On Thu, Jun 10, 2010 at 11:20 AM, Michael S. Zick <mszick@morethan.org>wrote:
> > On Thu June 10 2010, Nirmal Guhan wrote:
> > > On Thu, Jun 10, 2010 at 3:16 AM, Jon Bendtsen <jbendtsen@laerdal.dk>
> > wrote:
> > > > On 10/06/2010, at 04.32, Nirmal Guhan wrote:

> > > > > Hi,
> > > > > Does vserver provide any method for application virtualization
> > > > > (for instance, lxc can create application containers) ? i
> > > > > Please let me know.

the problem here is that nobody knows what you consider
'application virtualization'

Linux-VServer is modular and you can puzzle together the
various parts you want and leave out the part you do not
want or do not need, so you can start by a simple process
isolation (with chcontext) which will put your application
into a separate process/pid space and restrict the allowed
capabilities according to your setup. if you want, you can
add a separate filesystem namespace (directory tree) with
separate mounts, etc, or certain cgroup features, network
isolation or even a virtual network stack (via network
namespaces) ... where you stop for a single application
is up to you.

> > > > You could make a ultra minimal guest installation which basicly
> > > > is just your application and some needed libraries.

> > > > JonB

> > > Thanks. I assume I would also need the init files (inittab, rc.x
> > > etc.) for this to work?

not necessarily, depends on the kind of isolation you
are using, of course, with a separate filesystem namespace
you want to put everything into that namespace which is
required to run that application ... usually inittab and
the runlevel scripts will _not_ be required ....

> > A staticly linked copy of a stripped down Busybox should do the job.
> > Just be sure to enable a shell (ash?), init, mdev and <as required>
> > after doing an "all no" config.

> Will try this.

note: this is only one option, no need for an init or
a shell if all you are running is an isolated application

> > That would be pretty small, a few Mbytes probably.
> > How much overhead does using lxc add to the guest image?

> Actually nothing. 
> I just build the application the usual way and then use lxc-execute 
> to run it as container.

> I don't need rootfs or a guest image for that matter.

just means that you are using the root filesystem with
all security implications this has ... but if that is what
you want, you can definitely do it with Linux-VServer as
well ...

In general LXC is a subset of Linux-VServer because all
the virtualization mechanisms available in mainline are
as well available in Linux-VServer ...

HTC,
Herbert

> > And you could share that Busybox across guests.

> > Mike
> > > --Nirmal