From owner-freebsd-hackers@FreeBSD.ORG Wed May 16 12:17:49 2007 Return-Path: X-Original-To: freebsd-hackers@freebsd.org Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 2EA6816A403; Wed, 16 May 2007 12:17:49 +0000 (UTC) (envelope-from zec@icir.org) Received: from xaqua.tel.fer.hr (xaqua.tel.fer.hr [161.53.19.25]) by mx1.freebsd.org (Postfix) with ESMTP id B2E5813C45B; Wed, 16 May 2007 12:17:48 +0000 (UTC) (envelope-from zec@icir.org) Received: by xaqua.tel.fer.hr (Postfix, from userid 20006) id 49A6C9B648; Wed, 16 May 2007 13:52:21 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on xaqua.tel.fer.hr X-Spam-Level: X-Spam-Status: No, score=-3.9 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00, DATE_IN_PAST_06_12 autolearn=ham version=3.1.7 Received: from [::1] (zec1.tel.fer.hr [161.53.19.78]) by xaqua.tel.fer.hr (Postfix) with ESMTP id 257509B64A; Wed, 16 May 2007 13:52:19 +0200 (CEST) From: Marko Zec To: freebsd-hackers@freebsd.org Date: Wed, 16 May 2007 06:04:27 +0200 User-Agent: KMail/1.9.6 References: <45F1C355.8030504@digitaldaemon.com> <4648993A.4060709@elischer.org> <4648CAFD.4020009@freebsd.org> In-Reply-To: <4648CAFD.4020009@freebsd.org> MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200705160604.28402.zec@icir.org> X-Mailman-Approved-At: Wed, 16 May 2007 12:22:53 +0000 Cc: "Bjoern A. Zeeb" , Andre Oppermann , Julian Elischer , Ed Schouten Subject: Re: Multiple IP Jail's patch for FreeBSD 6.2 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 May 2007 12:17:49 -0000 On Monday 14 May 2007 22:47:57 Andre Oppermann wrote: > Julian Elischer wrote: > > Bjoern A. Zeeb wrote: > >> On Mon, 14 May 2007, Ed Schouten wrote: > >> > >> Hi, > >> > >>> * Andre Oppermann wrote: > >>>> I'm working on a "light" variant of multi-IPv[46] per jail. It > >>>> doesn't > >>>> create an entirely new network instance per jail and probably > >>>> is more suitable for low- to mid-end (virtual) hosting. In > >>>> those cases you normally want the host administrator to > >>>> excercise full control over IP address and firewall > >>>> configuration of the individual jails. For high-end stuff where > >>>> you offer jail based virtual machines or network and routing > >>>> simulations Marco's work is more appropriate. > >>> > >>> Is there a way for us to colaborate on this? I'd really love to > >>> work on this sort of stuff and I think it's really interesting to > >>> dig in that sort of code. > >>> > >>> I already wrote an initial patch which changes the system call > >>> and sysctl format of the jail structures which allow you to > >>> specify lists of addresses for IPv4 and IPv6. > > > > talk with Marko Zec about "immunes". > > > > http://www.tel.fer.hr/zec/vimage/ > > and http://www.tel.fer.hr/imunes/ > > > > It has a complete virtualized stack for each jail. > > ipfw, routing table, divert sockets, sysctls, statistics, netgraph > > etc. > > Like I said there is a place for both approaches and they are > complementary. A couple of hosting ISPs I know do not want to > give a full virtualized stack to their customers. They want to > retain full control over the network configuration inside and > outside of the jail. In those (mass-hosting) cases it is done > that way to ease support (less stuff users can fumble) and to > properly position those products against full virtual machines > and dedicated servers. Something like this: jail < vimage < > virtual machine < dedicated server. You're right we shouldn't look at virtualized stack as a replacement for jails. Every approach has its niche and use. > > He as a set of patches against 7-current that now implements nearly > > all the parts you need. It Will be discussed at the devsummit on > > Wed/Thurs and we'll be discussing whether it is suitable for > > general inclusion or to be kept as patches. Note, it can be > > compiled out, which leaves a pretty much binarily compatible OS, so > > I personally would like to see it included. > > I don't think it is mature enough for inclusion into the upcoming > 7.0R. Not enough integration time. Food for FreeBSD 8.0. Even not knowing how far exactly 7.0 is from being frozen and entering the release process, I'd agree with your point - the stack virtualization prototype for -CURRENT is still far from being ready for prime time. The fact that the patchsets I maintained for 4.11 were quite stable is of little significance now, given that the -CURRENT prototype is a from-scratch implementation of the same idea but using slightly different tricks, and of course the FreeBSD code base has evolved tremendeously over the years. What the prototype does demonstrate at this point however, is that the changes can be made to optionaly compile, that they should work fine on a multithreaded / SMP kernel, and that all this can be accomplished with relatively less churn to the existing code compared to what was done in 4.11 days. Knowing that I had a machine running a virtualized -CURRENT kernel under different kinds of workloads for over a month without a glitch might be considered encouranging but nothing spectacular... OTOH, even if we miss the window for sneaking this into 7.0-R, it would be a huge pitty not to at least reserve a few additional fields in various kernel structures needed to support stack virtualization. That way it would be possible to maintain a virtualized 7.0-R kernel in a separate code branch, which could be used as a snap-in replacement for the stock kernel even after API / ABI freeze comes into effect. This would allow us to give people an opportunity to conveniently test and play with the new framework on an otherwise production-grade OS, while continuing work towards (hopefully) merging of the chages into 8.0 at some point. Cheers, Marko