Jailhouse: A Linux-based Partitioning Hypervisor | Hacker News Reader

Jailhouse: A Linux-based Partitioning Hypervisor

github.com

56 pointsgluegadget16 comments

The official announce email ( https://lwn.net/Articles/574273/ ) provides a bit more detail, including a link to the Jailhouse presentation at this year's KVM Forum for the differences between KVM and Jailhouse: https://docs.google.com/file/d/0B6HTUUWSPdd-Zl93MVhlMnRJRjg

https://github.com/siemens/jailhouse

This is the most exciting kind of virtualization I've seen. I wish it was ready for prime time so I could use it for real!

This is interesting, in that it seems to be in compeiting space to LXC.. but makes use of VMX for machine isolation rather than using namespace / cgroups.

It's a shame they haven't provided some benchmarks...

It can't be competing with LXC, with LXC you can do over-provisioning of the server and maximize the utilization. With Jailhouse you under-subscribe your system in order to get maximal separation and performance guarantees.

I can see using this for real-time applications alongside management stuff and for separating critical and possibly buggy kernel drivers to where they can't harm the rest of the system.

Be fair. It can be said they compete, but, due to their very different design priorities, they don't compete directly.

I don't think the benchmarks make much sense in this situation, unless you measure server utilization and performance guarantees (which is the dimension in which they differentiate themselves).

You are right.

One could use LXC for completely allocating a CPU for some container so they can compete on one aspect. LXC still doesn't run on bare-metal and so can't take on the cpu separation for hardware accesses but there is a dimension in which they compete.

That's a really interesting idea - LXC and Jailhouse can be stacked in order to achieve both of their design goals.

I don't know why you're comparing it with LXC, rather than e.g. Xen or KVM which seems much more directly comparable.

They seemed to make a big deal about the bare metal aspect, and containing it... rather than traditional virt... Maybe i missunderstood?

Yes, and the "bare metal" aspect is more similar to Xen or KVM.

LXC is the exact opposite. It uses a shared kernel, while isolating various resources like networking, RAM, user IDs, etc between the different containers.

Xen or KVM provide something that looks like a bare metal computer.

The difference here, as far as I can understand, is that this is designed to be even more minimalist than what Xen or KVM gives you. Xen and KVM will still use some non-trivial amount of CPU resources on the CPU used by the guest (and depending in the setup may even share the CPU between different guests). This is designed to give the guest nearly complete control over the CPU, to allow you to run, say, a real-time operating system on one CPU, without interfering with the Linux kernel running on the others.

Xen and KVM also traditionally provide emulated devices that the guest talks to, while this just gives the guest direct access to the devices it needs.

So this is pretty much in exactly the opposite direction as LXC. The advantage of LXC is that containers are very lightweight, while still giving you a full Linux environment, as they share the kernel and lots of resources (like their root filesystem) with the host or other containers.

The advantage of Jailhouse is that the guest really gets full control of the CPU and hardware and very little interference, so you really can run a RTOS alongside a traditional Linux system.

There are a continuum of different virtualization designs; this extends the options available in a new direction. You use LXC if you want everything to be a Linux system sharing a kernel, and want control of what resources are shared vs. isolated. This can allow you to run a lot more VMs a lot more quickly and with lower resource impact than the other solutions. Xen or KVM if you want a full emulated virtual machine, which can run any OS that you want, and can share CPU, disk, and other resources with the host or other guests. Jailhouse if you basically want to have a separate computer sitting on the same motherboard.

How do guests (ehm, inmates?) get access to shared hardware?

As far as I can tell, there is no shared hardware. The point is that it dedicates certain hardware to the guests, and they have full access to it.

This is not supposed to fit into the same space as Xen or KVM; it's supposed to give the guest pretty much bare-metal control over the resources that you give it, with minimal interference from the host, so it can be used for real-time applications even if the host kernel is not real-time.

Ok, makes sense. But then "jail" is a bad name for it, I'm sure inmates have to use a lot of shared hardware in the real life. In fact "partition" conveys the right meaning.

I've been working with FreeBSD Jails for quite a while now and this looks like a clone for Linux.

For those who don't know, a FreeBSD Jail is a virtualization on the OS level (rather than Hardware level as provided by VirtualBox et al). It's similar in concept to creating a chroot, but you're also locking down processes.

http://www.freebsd.org/doc/handbook/jails.html

LXC is the Jails equivalent.

Jailhouse appears to be almost like an exokernel.

Reply on news.ycombinator.com