LightVM – A new virtualization solution based on Xen

http://cnp.neclab.eu/projects/lightvm/lightvm.pdf

by fanf2 • 9 years ago

215 55 9 years ago

cnp.neclab.eu

detaro6• 9 years ago

In case the ACM link isn't available to everyone, here is a copy hosted by NEC: http://cnp.neclab.eu/projects/lightvm/lightvm.pdf

michaelmior• 9 years ago

It would be nice if the mods could update to this link since it's accessible by anyone.

sctb• 9 years ago

Thanks, we've updated the link from https://dl.acm.org/citation.cfm?id=3132763&CFID=824760366&CF.... I'm not sure I've seen the ACM block traffic like that before.

detaro6• 9 years ago

I believe the CFID in the URL is a user-specific token, and user-specific URLs shouldn't be fetched from all over the world, triggering the block.

mapsnapps• 9 years ago

If I'm reading this right, that's pretty major. The isolation benefits of a VM with a bootspeed faster than docker?

tyingq• 9 years ago

https://hypercontainer.io is also in this space. Doesn't boot as fast as docker, but faster than a normal VM.

_joel• 9 years ago

Also Clear Containers from Intel - https://clearlinux.org/features/intel%C2%AE-clear-containers

lbotos• 9 years ago

I haven't been on the server side in a while, but 1) isn't Xen falling out of favor and 2) is docker boot speed a big problem?

weberc24• 9 years ago

Boot speed is a big selling point for Docker, but Docker's isolation story is poorer than a VM. If you can make a VM boot as quickly as Docker while preserving isolation, then Docker loses a big selling point.

hinkley• 9 years ago

Imagine you wanted to run ImageMagick in a docker image in order to reduce the attack surface. The container startup time could become a significant fraction of your image processing time.

nyrikki• 9 years ago

Xen is having a tough time keeping up with qemu/KVM which can take advantage of all the development time Intel spends on the kernel and the scheduler.

Obviously Xen will have a long life due to AWS, but I am failing to see anything that machined and kvm don't offer here on the performance oriented side.

There is probably be some use case but the xen time slice model doesn't seem to know enough about frequency binning or the impacts of high energy/heat instructions on them to be very competitive in the applications I can think of.

Dockers main problem is an increasing number of use cases, and their engineering decisions not meeting everyone's needs. To be honest if it wasn't for faux container support needs on windows/osx I am betting that systemd-nspawn would take over that market due to this.

For the most part docker performance is mostly limited by concurrency and amdahl's law (including fs perf). I don't see Xen solving these issues, but there are very real security benefits.

One very real use case I can think of is that any person or process that can launch a container on Docker is effectively given password-less sudo access, particularly because you can't disable the privileged flag. The attack surface on Xen would be much lower in that case but once the exploits start arriving docker could change that choice and reduce their attack surface quite a bit.

wkz3• 9 years ago

With the debugging benefits of a brick.

weberc24• 9 years ago

As long as debugging isn't fundamentally incompatible with a unikernel approach, it's just a matter of maturity. And it's pretty silly to criticize a new, prospective technology for immaturity.

est• 9 years ago

Maybe faster than docker, but how about Intel's Clear Containers?

https://lwn.net/Articles/644675/

jeromegn• 9 years ago

The project's page: http://cnp.neclab.eu/projects/lightvm/

metalliqaz2• 9 years ago

ACM can't handle the Hacker News flood.

sitkack• 9 years ago

I have had temporary bans on the ACM for opening 8 papers in a new tab. ACM can't handle the me.

metalliqaz2• 9 years ago

Sounds like ACM needs to learn how to Internet.

davidthewatson• 9 years ago

How is this different than zerovm?

http://www.zerovm.org/

detaro6• 9 years ago

It does not appear to be very similar at all.

burgerdev• 9 years ago

Maybe that ZeroVM is a NaCl sandbox, while LightVM is a Xen VM?

xmichael99• 9 years ago

ZeroVM, thanks for the link. I wonder if this solves glibc type dependencies across platforms, it seems unclear.

grabcocque• 9 years ago

So, unikernels?

detaro6• 9 years ago

No, not unikernels. They use unikernels and small linux builds for examples to show their improvement of Xen itself.

weberc24• 9 years ago

We achieve lightweight VMs by using unikernels for specialized applications

Unikernels appear to be part of the solution...

citrin_ru2• 9 years ago

We achieve lightweight VMs by using unikernels

One problems with unikernels is a lack of debugging/tracing tools (like Dtrace/eBPF): https://www.joyent.com/blog/unikernels-are-unfit-for-product...

nickik2• 9 years ago

That blog post is pretty crappy.

See discussions here: https://news.ycombinator.com/item?id=10953766

citrin_ru2• 9 years ago

The blog post has some flawed arguments, but still there is almost no observability/tracing tools for unikernels.

contingencies• 9 years ago

Great job and nice to see Romania featuring in the news!

To those who just spent the last two years retraining your teams and retooling your infrastructure explicitly for docker (who may show up in this thread embracing and enhancing with a large marketing budget shortly), do take this opportunity to learn the architectural and management/maintenance value of abstraction. ;)

tinco• 9 years ago

You do realize that Docker containers have an abstract interface and can be run on all OCI runtimes right?

bmitch3020• 9 years ago

VM's tend to lose the overlay layered filesystem which can dramatically reduce disk usage. Having the filesystem reset to a clean state for every new container is a huge feature of containers. And VM's tend to need predefined dedicated resources for things like memory. A process in a container would only allocate memory when it needs and can free up for other processes to use. It's not all about the startup speed.

That said, VM's have their place, and docker has the option to switch out backends. It's entirely possible to replace runc with some other tool that starts VM's instead of containers. (That's already happening today with Windows containers.)

jpalomaki• 9 years ago

Having the filesystem reset to a clean state for every new container is a huge feature of containers.

Could you use file system snapshots for this? Maybe also for the layers?

mastax• 9 years ago

If it works for docker[1], it probably works for this.

[1] https://docs.docker.com/engine/userguide/storagedriver/zfs-d...

tilpner• 9 years ago

An example for such an alternative backend would be runv, which can apparently be used with Docker (though I couldn't get it to work well, but that was probably just my fault)

https://github.com/hyperhq/runv#run-it-with-docker

ConfucianNardin• 9 years ago

The Tinyx tool mentioned in the paper doesn't seem to be published anywhere.

It doesn't help that the name was already in use (by a minimal X11 server).

monocasa• 9 years ago

Xen is very much inspired by exokernels (you could even make the argument that it is an exokernel), so it makes sense that someone would push it more in that direction.

That being said, if you're going to go that way,it's to bad that there isn't more inspiration from the past 20 years of OS design. A capability based security/object management interface would nice. I also really like Akaros's VM threads model; IMO that'll be the way we end up running what we currently call unikernels.

Rusky• 9 years ago

Akaros looks pretty interesting- the M:N aspect is certainly where I think we need to go.

CalChris• 9 years ago

it's to bad that there isn't more inspiration from the past 20 years of OS design. A capability based security/object management interface would nice.

Agreed and seL4 comes to mind. It's capability based, quite fast and secure. For that matter, it's also quite small.

robert_foss• 9 years ago

To save you some time, this is VMs + Unikernels.

equalunique3• 9 years ago

Unikernels were my first thought. Thank you for the summary.

detaro6• 9 years ago

It's not an accurate summary though, see the sibling comment to yours for a better one.

bildung• 9 years ago

Unikernels are mentioned in passing, but are not the cause of the speedup. The main point of the paper is instead the introduction of "LightVM, a complete re-design of the basic Xen control plane optimized to provide lightweight virtualization".

nwrk• 9 years ago

Super excited about this. Amazing progress. Kudos to authors.

LightVM – A new virtualization solution based on Xen

Related Stories