Should I choose KVM/XEN over OpenVZ or use them together

kvm-virtualizationopenvzvirtualization

I've got a dual xeon e5504 server, with [for now] only 8GB of ram. Storage is'n impressive either: 3x 146GB sas in raid5 + 500GB sata drives. Currently it works as a development server, but it's over speced for our needs and since our development methods changed through last 2 years we decided it will work as a production system for some of our applications + we would like to have a separate system for testing/research. Our apps are mainly web apps deployed on tomcats [plural as some of the apps require older versions] and connected to Postgres.

I would like to have a production system, where only httpd+tomcat+db are setup and nothing else runs there. Sterile system. Apart from that, I would like a test system, where I can play with different JVM settings, deploy my test apps, play with tomcat/httpd settings and restart them without interfering with the production system.

Apart from that, I would like to be able to play with different linux flavors, with newer kernels to test how they work etc. I know, this is not possible with OpenVZ and I would have to choose KVM for that. I am thinking about merging the two, and setting up a KVM to be able to work with different systems [linux only to be frank] + use openVZ to setup separate machines for my development needs. I would simply go with that, but reading here and there about the performance impact full virtualization has over containers and looking at the specs of my server makes me think twice about it. I don't want to loose too much performance, especially because of the nature of my apps [few JVMs running at the same time].

It will be my first time with virtualization, apart from using desktop virtualbox/vmserver. Although I am a fast learner I don't want to mess with the main system so much that it will break the production apps or make them crawl. Although they are more or less internal apps and they don't produce much load, they need to be stable.

I've read, that KVM host is a normal linux installation and it allows to run normal processes on it. If that is so, does it allow to run openVZ as well? I mean… can I have KVM and OpenVZ running on the same system/kernel? Or do I have to setup another system to run OpenVZ containers? How much performance impact can this have for me? Will my hardware suffice?

oh and one more thing… unfortunately I'm quite limited with the funds… I'm looking for a free solution only :/

Best Answer

The difference is the virtualisation approach, KVM is a kernel module (hence the name) that runs as part of the linux kernel, that allows for either native virtualisation or paravirtualisation. You're running a complete system environment.

Openvz runs the OS in containers - similar to BSD jails. Its more efficient when all your VMs are running the same OS (say linux), and effectively each 'guest' is an instance of an OS thats chrooted inside the main OS.

KVM will give you significantly more flexibility in terms of OS - you can run a windows or fbsd VM inside a KVM host. However, each VM will need to have hard disk images and memory allocated to them.

Openvz is better when you want to run a mass of linux VMs and need to be able to flexibly allocate resources between them. Since the systems are all using the same file system, kernel and memory space, a container dosen't need memory for its exclusive use.

Related Solutions

Xen KVM Virtualization – Comparing Xen vs. KVM in Performance

That benchmark is only comparing the speed of the native OS to a single guest OS. It is hardly a real-world test. I don't think I would put much weight on it. Most of the KVM camp argues that Xen requires too many interrupts and hops between kernel and user space, but from most of the more real-world benchmarks that I've seen that hasn't really been realized and Xen seems to be a bit faster than KVM.

Sorry I don't have a link to back that up handy. But I will say that KVM is improving fast and seems to be catching up on feature set and stability quickly.

As to which approach is better. The Xen camp will argue that a true light-weight hypervisor is required virtualization to be secure and fast. Xen is also starting to be supported in firmware by some vendors which is also nice. The KVM camp will argue that KVM is simpler and that Linux is capable of being a good hypervisor.

In the end it's still unclear which direction will ultimately win. Xen certainly has a head start and already has a nice market share. But it's not in the mainline kernel, yet. Hopefully that will change soon and there has certainly been a lot of talk about this on the kernel list in the past few months. Red Hat is in the KVM camp now and will be pushing it as the virtualization platform of choice. Red Hat Linux 5.4 which is coming out shortly will be the first to include it. So that will likely attract shops that haven't rolled out or committed to a virtualization platform yet.

As far as tools go, both Xen and KVM use libvirt and QEMU and the tools associated with them. So they share many of the same tools such as virt-manager.

We use Xen at work, and it works well for us. But I've been looking into KVM due to some USB forwarding and PCI passthrough issues I've been unable to resolve with Xen. I'm not sure KVM is any better at this, but I guess I'll find out once I try it. One thing I have noticed in researching my USB issues is that KVM's documentation is more assessable and organized compared to Xen's. But there is no perfect virtualization platform so you'll need to figure out what makes sense for you.

Firewall – Virtual environment firewall with CSF + iptables rules on VM

My advice is to perform the following on the hardware node:

If your HN has two interfaces, configure them both as bridges (in my case I have vmbr0 and vmbr1)
In the csf.conf, configure your ETH_DEVICE as "vmbr+"

Create a file called csfpost.sh in /etc/csf/ that simply allows forwarding:

#!/bin/sh 
IPT=/sbin/iptables 
$IPT -F FORWARD
$IPT -P FORWARD ACCEPT

Now your HN is protected on all interfaces, but will transparently pass traffic to and from your containers.
Configure your containers with CSF to keep them protected.

Notes
Make sure the modules needed for CSF are available to your VE's by placing the following in your /etc/vz/vz.conf:

 IPTABLES="iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc ipt_REDIRECT"

Also make sure that your value for "numiptent" value is around 256 or higher, the default or 128 will cause CSF to half-load on your VE's (see /proc/user_bean_counters to see if you're hitting the numiptent limit)

I've also added the above netfilter modules to my /etc/modules (1 per line). I'm not entirely sure if this is necessary. Hope this helps!

Best Answer

Related Solutions

Xen KVM Virtualization – Comparing Xen vs. KVM in Performance

Firewall – Virtual environment firewall with CSF + iptables rules on VM

Related Topic