Jailhouse Guest Support To Be Included With Linux 4.16

[oiaohm]

So by the sound of it is this a kind of new Xen?

Really no. Xen even in its para-virtualisation days had over-commit. KVM and Xen are both designed for over-commit usage,

There is a reason why you want a hyper-visor without over-commit.

https://www.youtube.com/watch?v=ZOGpNTn1tpw

Its in the risc-v prototypes. Labeled Risc-V.

The reality is if you want to user a hypervisor and have real-time performance in one of the VM on a multi core chip you will be doing it different to the way Xen and KVM have been done.

Siemens does a lot of medical items. Now getting a in kernel hyper-visor design to support the likes of Labeled Risc-v means they would be able to use a multi core chip and safely delicate sections of it to performing real-time tasks like like controlling a MRI scanner of course once the scan is complete be able to shut the real-time process down and use that core/cores for general processing.

Remember with aviation and medical certification design can take 4 to 5 years. So starting the jailhouse hypervisor now could be for what silicon will look like 4-10 years into the future. With risc-v particularly when can see the stuff being worked for 4-10 years into the future.

[RahulSundaram]

Docker does in fact use LXC. It's all part of the same kernel subsystem (containers).

No, Docker really does not use LXC at all. Common kernel features are used by several container implementations.

[pal666]

I wonder how this compares to running LXC user-mode containers. I use those a lot on servers to isolate processes like php and the web server in their own little read-only "jails". LXC is really fiddlely though and I hate using it

try systemd-nspawn

Things like KVM are too heavyweight because most of the time I'm basically creating "VM's" just for a single process.

this will be even more heavyweight - it is called partitioning because it takes whole resource from your host to give it to guest. for example it can't work on single-core cpus becaue it will give one core to one guest and host will not have access to that core anymore

[pal666]

Did you ever heard of Docker?

did you ever heard of rkt?

[tessio]

did you ever heard of rkt?

Yes..

[pal666]

Yes..

then you shouldn't suggest docker

[oiaohm]

try systemd-nspawn
this will be even more heavyweight - it is called partitioning because it takes whole resource from your host to give it to guest. for example it can't work on single-core cpus becaue it will give one core to one guest and host will not have access to that core anymore

True this is kind of a problem. But again if you look at prototype risc-v you have 4096 core chips. So it a question of when jailhouse comes into usage and on what hardware. On a 4096 core chip creating individual domains that applications stay inside may be a very good thing for performance.

For exist x86 hardware doing server loads this hardware is missing the risc-v labeled features it also missing massive number of cores so Jailhouse is most likely not the best fit.

But some embedded device with a quad core chip that need to perform some real-time tasks some of the time and the chip support labeled Item like jailhouse is good even in the case that you have a 4 core soc and you need 1 core for always required real-time and 3 cores have enough processing for other tasks in embedded system jailhouse will be good.

If 4096+ core per chip servers come common partitioning the hardware may be sanity. This is 4 to 10 years into the future when we find out what route the server world end up going.

So I see jailhouse as have very limit advantages for us right now on x86. But the company behind it is a major embedded device maker.

[tessio]

then you shouldn't suggest docker

you can't even build your on image using only rtk.. it's not a complete solution.

[pal666]

But again if you look at prototype risc-v you have 4096 core chips. So it a question of when jailhouse comes into usage and on what hardware. On a 4096 core chip creating individual domains that applications stay inside may be a very good thing for performance.

its purpose is not performance, but avoidance of interference from other guests or host. op had issues with kvm using too much resources, jailhouse uses even more. and obviously op does not have risc-v box

[pal666]

you can't even build your on image using only rtk.. it's not a complete solution.

i'll tell you more: it won't even boot without linux kernel.
using "only docker" is the main issue with docker. it is called vendor lock-in