5 ms·

I reach for LXC if I need to contain something inside it’s own OS, on the condition that the contained OS is running the same kernel as the host. As I understa

I reach for LXC if I need to contain something inside it’s own OS, on the condition that the contained OS is running the same kernel as the host. As I understand it, Xen would allow me to contain OSs that aren’t even Linux. What is available for Raspberry pi’s hardware, that I should try? Is there a compelling advantage to using Xen for a container Linux, versus LXC?

deleted 6y ago
[deleted]
dylz 6y ago
Xen is not a container, compare it to qemu/KVM more. I would not host untrusted customers in docker containers, LXC, but I would in Xen HVM any day.
- NullPrefix 6y ago
  >I would [..] host untrusted customers in [...] Xen HVM any day. Intel doesn't recommend running untrusted code even in a separate VM, according to their official explanation of Spectre/Meltdown. At least we can do it on RPi now.
  - pengaru 6y ago
    > At least we can do it on RPi now. Couldn't we already do it on an RPi with linux/kvm+qemu?
  - SturgeonsLaw 6y ago
    Not to mention if you give the untrusted VM a network interface then it can be the equivalent of plugging an untrusted computer into your network
    - emteycz 6y ago
      Huh? You can't make a VLAN or use a firewall?
  - s1dev 6y ago
    The A72 has speculative execution so I don’t think that’s strictly speaking true
danielheath 6y ago
> What is available for Raspberry pi’s hardware, that I should try? Windows runs on the pi4 (and now has x86 emulation, IIRC). There's more than a few things that only run on windows.
- WrtCdEvrydy 6y ago
  I wonder if HyperV is supported...
- dmos62 6y ago
  > Windows runs on the pi4 (and now has x86 emulation, IIRC). That's new to me. Is the rpi4 and window's x86 emulation performant enough to use popular windows-only apps like the Adobe suite?
  - vetrom 6y ago
    Microsoft Surface units in non-US markets have been available in ARM variants for some time now. There was some different market name for the unit but I can't recall what they're called just now.
t0astbread 6y ago
Security is one advantage. If you're running a server with multiple containers and you're concerned about attackers taking over one of those then you can isolate them more from each other and the rest of the system using VMs. (Addendum: I'm not that experienced when it comes to container tech and I heard you can isolate your containers pretty well these days. Virtualization has also changed over time and isn't as "isolated" as it was once; for example virtualized guests are often executed directly on the host's CPU. I'd definitely look into this more before deciding on one approach.)

deleted 6y ago

[deleted]

dylz 6y ago

Xen is not a container, compare it to qemu/KVM more. I would not host untrusted customers in docker containers, LXC, but I would in Xen HVM any day.

NullPrefix 6y ago
>I would [..] host untrusted customers in [...] Xen HVM any day. Intel doesn't recommend running untrusted code even in a separate VM, according to their official explanation of Spectre/Meltdown. At least we can do it on RPi now.
- pengaru 6y ago
  > At least we can do it on RPi now. Couldn't we already do it on an RPi with linux/kvm+qemu?
- SturgeonsLaw 6y ago
  Not to mention if you give the untrusted VM a network interface then it can be the equivalent of plugging an untrusted computer into your network
  - emteycz 6y ago
    Huh? You can't make a VLAN or use a firewall?
- s1dev 6y ago
  The A72 has speculative execution so I don’t think that’s strictly speaking true

danielheath 6y ago

> What is available for Raspberry pi’s hardware, that I should try? Windows runs on the pi4 (and now has x86 emulation, IIRC). There's more than a few things that only run on windows.

WrtCdEvrydy 6y ago
I wonder if HyperV is supported...
dmos62 6y ago
> Windows runs on the pi4 (and now has x86 emulation, IIRC). That's new to me. Is the rpi4 and window's x86 emulation performant enough to use popular windows-only apps like the Adobe suite?
- vetrom 6y ago
  Microsoft Surface units in non-US markets have been available in ARM variants for some time now. There was some different market name for the unit but I can't recall what they're called just now.

t0astbread 6y ago

Security is one advantage. If you're running a server with multiple containers and you're concerned about attackers taking over one of those then you can isolate them more from each other and the rest of the system using VMs. (Addendum: I'm not that experienced when it comes to container tech and I heard you can isolate your containers pretty well these days. Virtualization has also changed over time and isn't as "isolated" as it was once; for example virtualized guests are often executed directly on the host's CPU. I'd definitely look into this more before deciding on one approach.)