View source for Software:Linux-VServer

{{Short description|OS-level virtualisation}}
{{multiple|
{{Citations|date=January 2014}}
}}
{{Infobox software
| name = 
| logo = [[Image:Linux-VServer-logo.png|Linux-VServer]]
| screenshot = 
| caption = 
| developer = Herbert Pötzl (Community Project)
| latest release version = 2.6.22.19-vs2.2.0.7
| latest release date = {{start date and age|2008|03|14}}
| latest preview version = 4.9.159-vs2.3.9.8
| latest preview date = {{start date and age|2019|10|05}}
| operating_system = [[Software:Linux|Linux]]
| platform = [[X86|x86]], [[SPARC|SPARC/64]], [[PA-RISC]], s390x, [[MIPS architecture|MIPS/64]], [[ARM architecture|ARM]], [[PowerPC|PowerPC/64]], [[Engineering:Itanium|Itanium]]
| genre = OS-level virtualization
| license = [[Software:GNU General Public License|GNU GPL]] v.2
| website = {{URL|linux-vserver.org/}}
}}

'''Linux-VServer''' is a [[Virtual private server|virtual private server]] implementation that was created by adding operating system-level virtualization capabilities to the [[Software:Linux kernel|Linux kernel]]. It is developed and distributed as [[Open-source software|open-source software]].

==Details==
The project was started by Jacques Gélinas.  It is now maintained by Herbert Pötzl. It is not related to the [[Software:Linux Virtual Server|Linux Virtual Server]] project, which implements network [[Load balancing (computing)|load balancing]].

Linux-VServer is a [[Operating-system-level virtualization|jail mechanism]] in that it can be used to securely partition resources on a computer system (such as the [[File system|file system]], CPU time, network addresses and memory) in such a way that [[Process (computing)|processes]] cannot mount a [[Denial-of-service attack|denial-of-service attack]] on anything outside their partition.

Each partition is called a ''security context'', and the virtualized system within it is the ''virtual private server''.  A [[Software:Chroot|chroot]]-like utility for descending into security contexts is provided.  Booting a virtual private server is then simply a matter of kickstarting [[Software:Init|init]] in a new security context;  likewise, shutting it down simply entails killing all processes with that security context.  The contexts themselves are robust enough to boot many [[Software:Linux distribution|Linux distribution]]s unmodified, including [[Software:Debian|Debian]] and [[Software:Fedora (operating system)|Fedora]].

Virtual private servers are commonly used in web hosting services, where they are useful for segregating customer accounts, pooling resources and containing any potential security breaches.  To save space on such installations, each virtual server's file system can be created as a tree of [[Copy-on-write|copy-on-write]] [[Hard link|hard link]]s to a "template" file system.  The hard link is marked with a special filesystem attribute and when modified, is securely and transparently replaced with a real copy of the file.

Linux-VServer provides two branches, stable (2.2.x), and devel (2.3.x) for 2.6-series kernels and a single stable branch for 2.4-series.  A separate stable branch integrating the [[Software:Grsecurity|grsecurity]] patch set is also available.

==Advantages==
* Virtual servers share the same [[System call|system call]] interface and do not have any [[Emulator|emulation]] overhead.
* Virtual servers do not have to be backed by opaque [[Disk image|disk image]]s, but can share a common file system and common sets of files (through copy-on-write hard links).  This makes it easier to back up a system and to pool disk space amongst virtual servers.
* Processes within the virtual server run as regular processes on the host system.  This is somewhat more memory-efficient and I/O-efficient than whole-system emulation, although memory ballooning and modern VMs allow returning unused memory and sharing disk cache with the host and other virtual servers.
* Processes within the virtual server are queued on the same scheduler as on the host, allowing guest's processes to run concurrently on [[Symmetric multiprocessing|SMP]] systems.  This is not trivial to implement with whole-system emulation.
* Networking is based on isolation rather than virtualization, so there is no additional overhead for packets.
* Smaller plane for security bugs. Only one kernel with small additional code-base compared to 2+ kernels and large interfaces between them.
* Rich Linux scheduling features such as real-time priorities.

==Disadvantages==
* Requires that the host kernel be patched.
* No [[Computer cluster|clustering]] or [[Process migration|process migration]] capability is included, so the host kernel and host computer is still a single point of failure for all virtual servers.
* Networking is based on isolation, not virtualization. This prevents each virtual server from creating its own internal routing or firewalling setup.
* Some system calls (mostly hardware-related: e.g. [[Engineering:Real-time clock|real-time clock]]) and parts of the [[Procfs|/proc]] and [[Sysfs|/sys]] filesystems are left unvirtualized.
* Does not allow disk I/O bandwidth to be allocated on a per-virtual server basis.

==See also==
* [[Software:Comparison of platform virtualization software|Comparison of platform virtualization software]]
* Operating system-level virtualization

==References==
{{Reflist}}

==External links==
* [http://www.13thfloor.at/vserver/project/ Official releases]
* [http://linux-vserver.org/Linux-VServer-Paper Implementation paper]

{{Virtualization software}}
{{Linux kernel}}

{{DEFAULTSORT:Linux-Vserver}}
[[Category:Linux security software]]
[[Category:Linux kernel features]]
[[Category:Free virtualization software]]

{{Sourceattribution|Linux-VServer}}