Hans-Thomas Mueller wrote:
Another option instead of Xen or SELinux is to set up vservers_, with Grsec+Pax. The performance impact is minimal but you still get clean and isolated environments for your services.
I have a test server running under vserver and it was very easy to get it up and running, and although there appear to be some slight complications with networking, it's a really cool system. Thumbs up
I look forward to flexing this system a bit more, but the big win seems to be that all the memory and disk is still shared, unlike under Xen where you allocate it out and have to live with your decisions.
In the case where you don't normally expect hostile users to be trying to run more CPU or disk than they should then this is an enormously more flexible solution. For sure Xen may make more sense for certain hosted environments though (and you can pin VM machines down to certain limits even on vserver)
Give it a whirl - there are pre-merged patch sets for vserver + grsec + pax.
Ed W -- [email protected] mailing list
