For years, I\'m now using OpenVZ on my server, but support discontinued for Debi

Question

For years, I'm now using OpenVZ on my server, but support discontinued for Debian and Ubuntu, current releases seem to focus on LXC now, which is not a bad idea from the point of comfort.

But what about security? I remember I read once that LXC doesn't provide the same level of process and container separation than OpenVZ does. Unfortunately, I cant find the document anymore, but I agree there might be some security issues at least in the default configuration of LXC. For example, with a completely customized rootfs I managed once (in an older version of LXC) to change the host's terminal from an LXC container using chvt 1 and pressing Ctrl+C ended in a restart of my X11 environment when I tried to reproduce it today. I know, all container solutions use the same kernel and a kernel hack can lead to a container breakout, that's not what I ask. But it shouldn't be that easy to influence the host or other containers from a container.

How much security can I expect from OpenVZ and LXC?

My server exposes some guest ports to the internet, so I really care about this aspect, but I have to make a decision because the currently used tools need to be upgraded. Using KVM or similar is not an option since my server has a low-performance CPU.

Explanation / Answer

One of the most new and most promising security technique specific to LXC is the usage of low-privileged containers, which is possible only thanks to the tight integration of LXC within the Linux kernel. It relies on user's namespaces which allows the users within the LXC to be seen as some kind of "sub-users" from the container owner.

If the container owner is root, as it is required for most containers-like systems, this will not change anything in terms of security (or at least noticeably). However, the "magic" here is that the container can be owned by a unprivileged user, and in this case the container's root user will have the same privilege on the system as the container's owner, ie. the unprivileged user.

Related Questions

Navigate

• Browse (All)
• Browse F
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.