On Fri, Mar 02, 2007 at 08:41:48PM -0800, John R Pierce wrote:
> Paul wrote:
> >I second Solaris zones are very rubust. Easy to setup and maintain.
>
>
> otoh, for those who aren't familiar, Zones are NOT virtual machines,
> they are simply virtual USER spaces. all zones run directly under the
> 'host' kernel. the zones are more like a super-chroot, aka bsd 'jail',
> they have their own /etc/passwd and so forth, but they do NOT have the
> capability of running different OS's.
A bit more detail, also for those who aren't familiar...
Zones (or "containers") are closer to "vserver" and "jails" and other
variants like that rather than a true virtual machine . They are
lightweight containers with security seperation. As Solaris matures
additional resource limits are able to be placed on zones, but at the
moment it's a pretty "co-operative" in nature thus far (eg "projects"
_inside_ the zone). Security is absolute, CPU scheduling can controlled,
memory and I/O is a little weak. What makes zones quite neat is that
Sun have done a good job of updating lots of the tools to support them;
eg patching can patch every zone on a box at the same time. Building a
zone can take as little is 5 minutes and very little disk space if the
main filesystems are shared, or a lot longer if individual copies of
files are required.
Solaris 10 update 3 (or is it update 4?) will have "secure solaris"
extensions built in, based on zone technology. Each zone has a security
level and the OS can stop you from moving data from a restricted zone
to an open zone (for example). Quite neat. Sun even put a security
context onto each pixel of the X display to stop cut'n'paste from
breaching security!
--
rgds
Stephen
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
