Hacker News Reader

It is more costly, but this is a good reason to use a dedicated chunk of memory for every Xen PV domU. No oversubscription!

Allowing multiple domU VMs on the same dom0 (or the equivalent in other hypervisor platforms) to re-use memory and balloon/contract memory on the fly is what enables this.

View on HN

Can you point me to some services that provide, specifically, Xen PV VMs with non-oversubscribed memory?

I'm considering deploying a custom unikernel for protecting the private key data for my app[1], until I have enough money for a Hardware Security Module.

[1] http://security.stackexchange.com/questions/135457/penetrati...

Sorry, I can't, we use Debian stable + xen on our own bare metal hardware machines with from 256gb to 1tb of RAM. Never tried to buy a rental VM using the same dom0+PV setup. All of my off site VMs are for testing, some cheap $4/mo type openVZ that are basically glorified jails.

I'm not sure if anyone actually oversubscribes ram with Xen. But we (prgmr.com) still allow you to order PV VMs, mostly because NetBSD performance is abysmal in HVM mode.

I suppose this would still be susceptible to this class of attack: https://www.usenix.org/conference/usenixsecurity16/technical...

Unless you're very careful about which ranges of physical memory are mapped to each VM.

Reply on news.ycombinator.com