<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
<div class="moz-cite-prefix">03/07/2016 07:55 PM tarihinde Rahul
Rege yazdı:<br>
</div>
<blockquote
cite="mid:CAKnejoCc6CDKuknAYNy3AsmcGxx+SwVBO5PZvCJ6KkE6C0rQbw@mail.gmail.com"
type="cite">
<div dir="ltr">Hi,
<div><br>
</div>
<div>While this is not a question specifically for LXC/LXD, I
thought I'd ask to get the general opinion about the
multi-tenancy and its support in LXD (the nova-compute for
same already gives some good ground).</div>
<div><br>
</div>
<div>Its my understanding from the general reading that the
Linux kernel is not made for multitenancy, so if I am to
implement a solution with say LXD to run on baremetal servers,
ideally I cannot put different customers containers on the
same host because of the potential security issues (I fully
don't understand what those are)</div>
<div><br>
</div>
</div>
</blockquote>
Why do you think lxc/lxd has of the potential security issues?<br>
<br>
Please look at proxmox container!<br>
<a href="http://www.proxmox.com/en/proxmox-ve/features">http://www.proxmox.com/en/proxmox-ve/features</a><br>
It use lxc for container. <br>
<br>
I am thinking lxc + apparmor + cgroups + lvm or raw image file(for
container file system) are enough for security. <br>
<br>
we know setup is not easy therefore we use proxmox for lxc
management . :-)<br>
<br>
If you have experience with " lxc + apparmor + cgroups + lvm or
raw image file(for container file system)", you can try proxmox.<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAKnejoCc6CDKuknAYNy3AsmcGxx+SwVBO5PZvCJ6KkE6C0rQbw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>While different security techniques like Apparmor, selinux
and some capability restriction can achieve what we want
ultimately, I wanted to understand if people are generally
doing it with LXD or would potentially do it OR ultimately
it'd follow the pattern of running them on the VMs which
provide the needed isolation.</div>
<div><br>
</div>
<div>Companies like Joyent with their Triton containers do it I
believe and claim some really awesome performance with their
SmartOS as the special os.</div>
<div><br>
</div>
<div>PS - This might be a well known consideration in container
world, so pardon me if this is something trivial and already
discussed.</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks </div>
<div>Rahul Rege</div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
lxc-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a>
<a class="moz-txt-link-freetext" href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a></pre>
</blockquote>
<br>
</body>
</html>