LVE: an alternative container technology to Docker and Virtuozzo/LXC
blog.phusion.nl
blog.phusion.nl
The big difference with LVE is that it works at a thread level, such that you can, for example, place one http request within a running apache instance into a specific user's cgroup. That makes it useful in shared hosting environments, where multiple end users are sharing one instance of apache, mysql, etc.
The trouble with this, to me, is that shared hosting is on its deathbed. It is more efficient than the VPS model, but so much money is going into the VPS world (digitalocean, linode, ovh, etc). Thus, that efficiency edge doesn't translate into any cost savings for the end user.
Shared hosting seems to survive solely because they provide some amount of managed service and somewhat end user friendly interfaces (cpanel). Sooner or later, though, players like DigitalOcean will fill that gap, with things like their "one click installs", improved control panels, etc.
I'm not sure if there's another use case for LVE outside of shared hosting.
The efficiency does translate into a saving for those hosters, as it is common to see 2,000 Happy customers on a 16GB server. Something completely impossible with VPS.
This is true from a hardware standpoint. However, after paying for CloudLinux and Cpanel licenses, the advantage may falter.
And, they are racing deeper pockets to the bottom.
Right now we run a separately contained process for each account, but per-thread containment could help us gain some of the advantages of the fully multi-tenant architecture without losing the account isolation.
For cloudlinux customers (shared hosting providers) the typical things they need already have the mods put in by cloudlinux (apache, mysql,etc).
Since cloudlinux is, I believe, based on an older version OpenVZ, you would also have to likely backrev to a 2.6.x kernel.
Both most often do not use distinct vms per user.
Proprietary is the main reason why it will lose to containers.
"Unlike Docker, Virtuozzo and LXC, which operate on the process level, LVE is able to operate on the thread level. This allows multithreaded servers such as Apache (with its 'worker' MPM) to take advantage of LVE without having to run a separate instance per LVE user."
This is the other reason why it will lose: Increased attack surface to every API of every single process they use on the shared server, AKA "bad neighbor effect" with a vengeance.
And I'm not sure this model would work well with pool-based concurrency models (like with nginx, where work is given to workers, workers aren't spawned for each request).
However, it would be cool if this was just merged upstream, so that Apache could take advantage of the resource limiting. I'm not sure that it's a good general solution for shared hosts though (then again, you never trust shared hosts after you pop your first shell).
I'm confused about the proprietary bit. As far as I can find they released a kernel module in the past that was in violation of the GPL but then redressed the issue by releasing the sources under the GPL. Does anyone know what the current state is?
(IANAL, ...)