What are the best approaches to OS virtualization?

5

Options
Considered

7

User
Recs.

Dec 17, 2015

Last
Updated

Here’s the Deal

5 Options Considered

Best approaches to OS virtualization	Price	Last Updated
-- Hypervisor + Container	-	Dec 17, 2015
-- Hypervisor + Unikernel	-	Dec 17, 2015
-- Type 1 Hypervisor	-	Dec 17, 2015
-- Container	-	Dec 17, 2015
-- Type 2 Hypervisor	-	Apr 17, 2015

Hypervisor + Container

Add Video or Image

Top Pro

Lightweight

Containers are based on shared operating systems. This makes them very lightweight and efficient because they don't have to virtualize any hardware, instead they rest on top of a single Linux instance. See More

Top Con

Not secure

Containers are not very secure. They are practically sharing so much of their underlying OS that it can't be fully secured. See More

Top Pro

For-purpose hypervisors with accompanying hardware are being developed

LXD, a hypervisor that is focused entirely on containers is being developed by Ubuntu. This new hypervisor will provide an added layer of security that is needed for containers. But what's more is that this won't simply be a security approach. Work is being done to make hardware that will provide isolation of the containers at the chip level. See More

Hypervisor + Unikernel

Add Video or Image

Top Pro

Unikernels allow for advanced security measures

Since it's possible to spin up a lot of unikernels with little cost they can be used to delay, confuse and trap the intruder. See More

Top Con

Pivoting is expensive

Top Pro

Quick boot times

Hypervisors boot faster than a typical Linux kernel + userspace. Which is a great benefit when you have to boot a lot of VM instances. See More

Top Con

Increased development time

Not a lot of core peaces yet. See More

Top Pro

Significantly reduced attack surface

In addition to security benefits provided by a hypervisors the fact that only certain parts of certain libraries of an OS are used mean that only the essential components can be targeted not the cruft that comes with a full-fledged OS. See More

Top Con

Useful only in specialized cases

Generally anything that requires a local disk (with some rare exceptions) won't be good fits for Unikernels. See More

Top Pro

Unavoidable functionality can be added to networking

Between the hypervisor's management domain and an unprivileged domain unavoidable functionality such as encryption, filtering or tunneling can be implemented. The added latency is almost unnoticeable. See More

Top Pro

Small overhead and increased performance

Unikernels are built to run only the necessary processes with only the necessary parts of necessary libraries in order to vastly increase performance. They reduce the memory footprint, the need for disk space and computational burden. See More

Type 1 Hypervisor

Add Video or Image

Top Pro

Can run multiple operating systems

Hypervisors can emulate hardware separately for each host allowing them to run multiple operating systems. See More

Top Con

Considerable overhead

Depending on the host hypervisor may take up anywhere from 3% of the hosts memory and cpu resources up to 35%. Low density, performance, scalability. While some issues are mitigated with new hardware features such as VT-D, the overhead is considerable. In certain specialized cases many of these issues can be sidestepped via the use of unikernels. Unikernels are specialized, lightweight operating systems for hypervisors. They are built to run only the necessary processes with only the necessary parts of necessary libraries in order to vastly increase performance. They reduce the memory footprint, the need for disk space and computational burden. Additionally they further reduce the attack surface. See More

Container

Add Video or Image

Top Pro

High portability

The whole stack can be easily packed and moved. See More

Top Con

Security concerns

Since containers are run using shared resources, if any container is compromised, the host is compromised as well. Many of the security concerns can be alleviated by running containers within hypervisors. See More

Top Pro

Fast startup times enable a highly flexible infrastructure

New containers can be quickly spun up based on changing need. See More

Top Con

Limited to one kernel and OS

All containers on a host will have the same kernel and OS. See More

Top Pro

High density

Two to six times more virtual environments can be created via containers as compared to hypervisors for the same hardware cost since containers don't need to emulate hardware and repeating OS elements for each guest OS. See More

Top Pro

Dynamic resource allocation

Containers can be assigned, for example, more memory during runtime. See More

Request recommendations from the community

Explore Related Questions

Help millions of people make better decisions.

Each month, over 2.8 million people use Slant to find the best products and share their knowledge. Pick the tags you’re passionate about to get a personalized feed and begin contributing your knowledge.