Hacker News Reader

Comment by kalleboo | Hacker News Reader

So in the end, we're reinventing the OS with a hypervisor acting as the kernel? Are the current hypervisors better or worse than the Linux kernel at this task? What's the reason people don't just run these processes straight in a regular Linux install with properly configured users/chroots/quotas?

View on HN

I for one, really dislike this drive towards VMs for everything.

VMs are mostly about solving the same problems that operating systems were there to solve in the first place, only slower.

I personally think that part of the problem is the way software is installed and configured by modern package managers and distributions. It makes people see the installed software as part of the operating system almost. If you want two webservers with different configurations you therefore need two operating systems.

The concept for creating a couple of different users and running the software out of each one seems foreign to modern system admin these days.

One additional reason for the popularity of VMs in enterprise environments is that software vendors will often refuse to support applications on servers that have other applications installed.

Supporting high-availability of guest servers by allowing "live" migration from one host to another is pretty cool as well - either for fail-over or to allow hardware maintenance.

The default position these days in enterprise environments seems to be that a server will be a VM unless you have a really strong case for having dedicated hardware (and that only ever seem to apply for database clusters).

The sole reason for Xen etc is that people were too lazy to do microkernels in the first place. It is exactly the same thing as we are seeing in the web browser with all the low level primitives like asm.js and WebGL: the good ideas inevitably start to creep back in (even if in a crap, watered-down form at first) given enough time. In fact, we could easily have proper MMU sandboxing in the browser by now if we were running proper microkernels. Instead we'll pay big performance and complexity overheads to do it in userspace.

Just creating a couple of different users does not give nearly the level of isolation a VM does.

Just off the top of my heads, some benefits of VMs vs processes: - you get the encapsulation/isolation out of the box - abstraction from the hardware; may not seem like a big deal if you're thinking in terms of a single machine but very useful for migration (whether live migration or cold migration) between different machines - ability to snapshot the state - arguably a smaller attack surface since you deal with fewer drivers inside the virtual machine versus a general purpose OS (VM escape exploits do exist though - no denying that).

Using a VM can also reduce copying of data, particularly in the network stack.

cgroups help solve the same problem, for tasks.

I suspect running properly isolated JVMs directly on host kernel would be faster than going through the hypervisor. I would love to see benchmarking numbers.

But there are two problems on why people keep reinventing the wheel:

- Current solution Isn't Sexy Enough, aka Not Invented Here.

- Current corporate culture drives acquisitions of tech startups based on a) business, i.e. number of users, and b) innovative technology that doesn't exist anywhere else, reinforcing previous point.

All this work to come up to yet another solution to the same old problems (IBM solved machine partitioning around 70s ?) is happening because engineers love to work on their specific pet projects and not solve other people's problems.

Not that there's anything wrong with that.

Architecturally, there's no real difference.

However in the real world there are self-service clouds which offer cheap, easy to consume VM containers. So having a JVM which runs directly in these containers makes some sense. (The alternative would be to persuade Amazon to let you run your JVM as a host process using LXC or something .. good luck with that)

I guess I'd have to see some compelling benchmarks of a JVM on OSv vs a JVM in a more traditional VM image.

OK, so run your JVM on something like Heroku or dotCloud that does use LXC. Too bad those are in turn running on EC2, not on bare metal.

Yes, processes are a long forgotten form of virtualization. You are spot on there.

They are pretty good :)

The hardware has added a new form of isolation in addition to just memory protection though, that the process alone can't use.

This isolation comes at the cost of dramatically decreased performance.

http://dtrace.org/blogs/brendan/2013/01/11/virtualization-pe...

Hardware virtualization is best viewed as a hack for running multiple operating system kernels at the same time, where each kernel is designed to have a machine to itself. In any sanely designed system, this shouldn't be necessary; multiple processes under a single shared kernel should be good enough.

While that is a nice ideal, reality tends to start creeping in eventually, and a hack or two become necessary so work can get done.

Reply on news.ycombinator.com