<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi,</div><div><br></div><div>At first, thanks for all the great feedback and the quickly ongoing development to lxc.</div><br><div><div>On May 13, 2010, at 11:22 PM, Daniel Lezcano wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On 05/13/2010 06:17 PM, Christian Haintz wrote:<font class="Apple-style-span" color="#006312"><br></font><blockquote type="cite">6) is LXC production ready?<br></blockquote><br>yes and no :)<br><br>If you plan to run several webserver (not a full system) or non-root applications, then yes IMHO it is ready for production.<br><br>If you plan to run a full system and you have very aggressive users inside with root privilege then it may not be ready yet. If you setup a full system and you plan to have only the administrator of the host to be the administrator of the containers, and the users inside the container are never root, then IMHO it ready if you accept for example to have the iptables logs to go to the host system.</div></blockquote><div><br></div>In my opinion there is not a big different if i run some software which might have a security bug which people could exploit or if i have a root user who trys to escape the container. In both ways i need isolation which i can trust.</div><div>For me this is the main reason doing things in isolation like lxc or openvz, because i don't need the overhead of kvm or xen but i still need isolation which jail a software or a system - root users inside or not.</div><div><br></div><div>It looks to me like you already know a way how to escape from a container, don't you? And if so, is that a desired behavior or just a bug?</div><div>The point i'd like to come: Is one goal of lxc to make it a container where nothing/nobody can escape or is this feature just "nice-to-have" but not a "must have" on the roadmap? </div><div><br><blockquote type="cite"><div><br>Really, it depends of what you want to do ...<br><br>I don't know OpenVZ very well, but AFAIK it is focused on system container while LXC can setup different level of isolation allowing to run an application sharing a filesystem or a network for example, as well as running a full system. But this flexibility is a drawback too because the administrator of the container needs a bit of knowledge on the system administration and the container technology.<br></div></blockquote><div><br></div><div>For me, all aspects of lxc are interesting, I am not only focused to full system virtualization. I am also thinking of jailing just some apps with some libs in containers (e.g. python). But in the end, for me it is about encapsulation with no escape :-) </div></div><br><div>Regards,</div><div>Christian</div><br><div> <span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">--</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">Christian Haintz</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">Student of Software Development and Business Management</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">Graz, University of Technology</div></div></div></span> </div><br></body></html>