3 ms·

I sincerely would love to hear of the concrete problems with Solaris Zones, because I am deploying a system based on Solaris Zones very soon. I don't think sec

I sincerely would love to hear of the concrete problems with Solaris Zones, because I am deploying a system based on Solaris Zones very soon. I don't think security is an issue--it is true that there could be a security bug that would let some malicious code escape from a non-global zone to the global zone. But, AFAICT, that could happen with Xen too. Plus, if there is malicious code executing in a non-global zone then I'm already screwed since that is where my applications and data are. Xen's live migration requires shared storage (AFAICT), which I don't have. That means that for my systems, Xen migration would work exactly the same as Zones migration (shut down the guest, move it to the new system, and start it up). I chose Solaris Zones because (1) Zones have extremely low resource consumption, (2) they are extremely simple to manage, (3) they are extremely simple to backup and restore when the zone is on ZFS, and (4) I get to use all the Solaris manageability features.

tptacek 18y ago
Let's start with I have a documented security finding in Zones; I'm not sure if it's been published and patched yet, and I'm not pointing it out, but you can track me down on LinkedIn or, I don't know, a lot of other places if you need bona fides. Then think about the difference between Xen and Zones: Zones share a kernel. Xen machines do not. This has two security implications: * It is possible for there to be bugs that will allow one zone to see kernel resources (files, sockets, pids, IPC descriptors, etc) from another zone. It is impossible for that to happen with Xen, because VMs don't even know about each other. * The majority of Solaris (and Linux) kernel vulnerabilities in the last several years have been kernel vulnerabilities, which Zones don't protect you from. The Xen hypervisor is significantly smaller than the Solaris kernel, and has had a far better security track record.

tptacek 18y ago

Let's start with I have a documented security finding in Zones; I'm not sure if it's been published and patched yet, and I'm not pointing it out, but you can track me down on LinkedIn or, I don't know, a lot of other places if you need bona fides. Then think about the difference between Xen and Zones: Zones share a kernel. Xen machines do not. This has two security implications: * It is possible for there to be bugs that will allow one zone to see kernel resources (files, sockets, pids, IPC descriptors, etc) from another zone. It is impossible for that to happen with Xen, because VMs don't even know about each other. * The majority of Solaris (and Linux) kernel vulnerabilities in the last several years have been kernel vulnerabilities, which Zones don't protect you from. The Xen hypervisor is significantly smaller than the Solaris kernel, and has had a far better security track record.