Bryan Cantrill on Jails and Solaris Zones

Bryan Cantrill traces the history of OS-level virtualization, comparing FreeBSD Jails and Solaris Zones and their evolution from chroot.

Meetup: bit.ly/24BICms Papers: bit.ly/1OQu5YB & bit.ly/21HNDYf Slides: bit.ly/1QmCSWr Audio: bit.ly/1T8uYUb ----------------------------------------------------------------------------------------------------------- Sponsored by Two Sigma (@twosigma) and Enigma (@enigma_io) ----------------------------------------------------------------------------------------------------------- Description ------------------ Jails: Confining the omnipotent root. ============================== The traditional UNIX security model is simple but inexpressive. Adding fine-grained access control improves the expressiveness, but often dramatically increases both the cost of system management and implementation complexity. In environments with a more complex management model, with delegation of some management functions to parties under varying degrees of trust, the base UNIX model and most natural extensions are inappropriate at best. Where multiple mutually untrusting parties are introduced, "inappropriate" rapidly transitions to"nightmarish", especially with regards to data integrity and privacy protection. The FreeBSD "Jail" facility provides the ability to partition the operating system environment, while maintaining the simplicity of the UNIX "root" model. In Jail, users with privilege find that the scope of their requests is limited to the jail, allowing system administrators to delegate management capabilities for each virtual machine environment. Creating virtual machines in this manner has many potential uses; the most popular thus far has been for providing virtual machine services in Internet Service Provider environments. Solaris Zones: Operating System Support for Consolidating Commercial Workloads ================================================ Server consolidation, which allows multiple workloads to run on the same system, has become increasingly important as a way to improve the utilization of computing resources and reduce costs. Consolidation is common in mainframe environments, where technology to support running multiple workloads and even multiple operating systems on the same hardware has been evolving since the late 1960’s. This technology is now becoming an important differentiator in the UNIX and Linux server market as well, both at the low end (virtual web hosting) and high end(traditional data center server consolidation).This paper introduces Solaris Zones (zones), a fully realized solution for server consolidation projects in a commercial UNIX operating system. By creating virtualized application execution environments within a single instance of the operating system, the facility strikes a unique balance between competing requirements. On the one hand, a system with multiple workloads needs to run those workloads in isolation, to ensure that applications can neither observe data from other applications nor affect their operation. It must also prevent applications from over-consuming system resour