5 ms·

User-mode Linux Kernel

31 points by grifaton 16y ago

dgl 16y ago
When there weren't so many options for Linux virtualisation this was where Linode started out: http://www.linode.com/wiki/index.php/Linode#What_makes_a_Linode_different.3F http://www.linode.com/wiki/index.php/Linode#What_makes_a_Lin...
rythie 16y ago
We used that for quite a few years, were able to get 40-50 VMs on a Dual-Xeon box with 6GB of memory with no trouble. It's very lightweight and flexible with memory compared to systems like KVM and VirtualBox
hapless 16y ago
I used to have paying customers on UML on a Red Hat 7.3 box. I had no idea that UML had been maintained as recently as 2.6.24. I really had no reason to follow it, because UML's niche has been eaten away from both top and bottom. The bottom: For super-high-density virtual private servers, it makes more sense to use OpenVZ (http://www.openvz.org http://www.openvz.org) and its commercial counterpart, Virtuozzo (http://www.parallels.com http://www.parallels.com). I've seen installations with 300-500 VMs running on a system with 2G of RAM. It's not a great user experience, but it sure is ... dense. This is where those $5/month VPSes came from. The top: For more conventional virtualization needs, there's Xen and KVM. More flexible, less of a pain in the system administrator's ass. This is the route Slicehost and Linode took.
- nepenthe2 16y ago
  Just an FYI, Linode used to have UML "back in the day." There was an interesting quote about a year ago from the CEO of Linode regarding uncertainty of staying with Xen and instead moving on to KVM. http://searchservervirtualization.techtarget.com/news/1516376/Cloud-service-providers-weigh-Xen-to-KVM-move?track=sy420 http://searchservervirtualization.techtarget.com/news/151637...
  - regularfry 16y ago
    That's not an uncommon experience: http://blog.bytemark.co.uk//2011/02/28/why-we-skipped-xen http://blog.bytemark.co.uk//2011/02/28/why-we-skipped-xen
- petercooper 16y ago
  What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.
  - justincormack 16y ago
    Use Linux containers (lxc). Exactly what you need...
    - petercooper 16y ago
      I'll have a dig into that next then - thanks! :-)
    - nwmcsween 16y ago
      Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.
  - nwmcsween 16y ago
    There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.
  - hapless 16y ago
    I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful. You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies. If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.
otterley 16y ago
Not news. UML is at least 12 years old.
nzmsv 16y ago
There even exists a port of UML for Windows: http://umlwin32.sourceforge.net/ http://umlwin32.sourceforge.net/ And that project (indirectly) led to coLinux (http://www.colinux.org/ http://www.colinux.org/), which runs on Windows at the kernel level. Linus himself called coLinux a dirty hack!
alextp 16y ago
UML brings back good memories from OS classes. We had to patch ext3 to add some triviality, and I did it first in UML so I could more easily test and make sure it was working correctly. It felt a lot faster and easier to setup than virtualbox or qemu (my options at the time), although I guess with hardware support and things like hypervisors it's no longer practical.
anonymous246 16y ago
What? That's it? Flagged.
- anonymous246 16y ago
  Dear downmodders, the submitter should have at least put the fig leaf of an "Ask HN" sentence around this to make this interesting. Otherwise, a post to the homepage of a 12-yr old project makes no sense and is polluting HN.
  - sorbus 16y ago
    Comments which complain about articles polluting HN and say nothing other than that the commenter is flagging it are polluting HN, and are against the guidelines: "Please don't submit comments complaining that a submission is inappropriate for the site. If you think something is spam or offtopic, flag it by going to its page and clicking on the "flag" link. (Not all users will see this; there is a karma threshold.) If you flag something, please don't also comment that you did."
    - anonymous246 16y ago
      Fair enough. Noted. Thanks for replying.
- jrockway 16y ago
  Yeah, where's the Apple logo, right?
pan69 16y ago
Interesting. Is this similar to CouldLinux? http://www.cloudlinux.com http://www.cloudlinux.com
- nepenthe2 16y ago
  Cloud Linux is marketed towards shared hosting providers, often the kind that might have 300-2000 websites on a single server. The isolation prevents rogue PHP scripts from taking down the entire server normally seen with non-updated/misconfigured WordPress or common forum software.

31 points by grifaton 16y ago

dgl 16y ago

When there weren't so many options for Linux virtualisation this was where Linode started out: http://www.linode.com/wiki/index.php/Linode#What_makes_a_Linode_different.3F http://www.linode.com/wiki/index.php/Linode#What_makes_a_Lin...

rythie 16y ago

We used that for quite a few years, were able to get 40-50 VMs on a Dual-Xeon box with 6GB of memory with no trouble. It's very lightweight and flexible with memory compared to systems like KVM and VirtualBox

hapless 16y ago

I used to have paying customers on UML on a Red Hat 7.3 box. I had no idea that UML had been maintained as recently as 2.6.24. I really had no reason to follow it, because UML's niche has been eaten away from both top and bottom. The bottom: For super-high-density virtual private servers, it makes more sense to use OpenVZ (http://www.openvz.org http://www.openvz.org) and its commercial counterpart, Virtuozzo (http://www.parallels.com http://www.parallels.com). I've seen installations with 300-500 VMs running on a system with 2G of RAM. It's not a great user experience, but it sure is ... dense. This is where those $5/month VPSes came from. The top: For more conventional virtualization needs, there's Xen and KVM. More flexible, less of a pain in the system administrator's ass. This is the route Slicehost and Linode took.

nepenthe2 16y ago
Just an FYI, Linode used to have UML "back in the day." There was an interesting quote about a year ago from the CEO of Linode regarding uncertainty of staying with Xen and instead moving on to KVM. http://searchservervirtualization.techtarget.com/news/1516376/Cloud-service-providers-weigh-Xen-to-KVM-move?track=sy420 http://searchservervirtualization.techtarget.com/news/151637...
- regularfry 16y ago
  That's not an uncommon experience: http://blog.bytemark.co.uk//2011/02/28/why-we-skipped-xen http://blog.bytemark.co.uk//2011/02/28/why-we-skipped-xen
petercooper 16y ago
What about for sandboxing processes? I've been investigating UML for this use as it seems "lighter" than the other approaches you've outlined yet still gives good network separation and reasonable control from a supervising process. I've also been investigating AppArmor but it seems a little like wrapping a blanket around a bomb so far.. but I'm really just walking around in the dark so far.
- justincormack 16y ago
  Use Linux containers (lxc). Exactly what you need...
  - petercooper 16y ago
    I'll have a dig into that next then - thanks! :-)
  - nwmcsween 16y ago
    Linux containers don't offer real separation right now, there are still data leaks and issues such as shutdown -h within a lxc causing the host to shutdown and many other issues. Lxc as of now is barely alpha quality.
- nwmcsween 16y ago
  There's quite a few sandboxing systems out there: sydbox which is a ptrace based sandbox, gentoo's sandbox which uses LD_PRELOAD, plash which uses a modified version of glibc and thus shared libs.. Take your pick. Personally I would just use openvz and be done with it.
- hapless 16y ago
  I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful. You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies. If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.

otterley 16y ago

Not news. UML is at least 12 years old.

nzmsv 16y ago

There even exists a port of UML for Windows: http://umlwin32.sourceforge.net/ http://umlwin32.sourceforge.net/ And that project (indirectly) led to coLinux (http://www.colinux.org/ http://www.colinux.org/), which runs on Windows at the kernel level. Linus himself called coLinux a dirty hack!

alextp 16y ago

UML brings back good memories from OS classes. We had to patch ext3 to add some triviality, and I did it first in UML so I could more easily test and make sure it was working correctly. It felt a lot faster and easier to setup than virtualbox or qemu (my options at the time), although I guess with hardware support and things like hypervisors it's no longer practical.

anonymous246 16y ago

What? That's it? Flagged.

anonymous246 16y ago
Dear downmodders, the submitter should have at least put the fig leaf of an "Ask HN" sentence around this to make this interesting. Otherwise, a post to the homepage of a 12-yr old project makes no sense and is polluting HN.
- sorbus 16y ago
  Comments which complain about articles polluting HN and say nothing other than that the commenter is flagging it are polluting HN, and are against the guidelines: "Please don't submit comments complaining that a submission is inappropriate for the site. If you think something is spam or offtopic, flag it by going to its page and clicking on the "flag" link. (Not all users will see this; there is a karma threshold.) If you flag something, please don't also comment that you did."
  - anonymous246 16y ago
    Fair enough. Noted. Thanks for replying.
jrockway 16y ago
Yeah, where's the Apple logo, right?

pan69 16y ago

Interesting. Is this similar to CouldLinux? http://www.cloudlinux.com http://www.cloudlinux.com

nepenthe2 16y ago
Cloud Linux is marketed towards shared hosting providers, often the kind that might have 300-2000 websites on a single server. The isolation prevents rogue PHP scripts from taking down the entire server normally seen with non-updated/misconfigured WordPress or common forum software.