0

Stumbled upon a privacy conscious hosting provider that uses LXD vs KVM to manage user VPS instances.

My understanding is KVM is more isolated so using LXD doesn’t make sense from a privacy perspective.

Perhaps I am missing something?

3

LXD is a container technology. It uses Linux namespaces, i.e. the processes inside an LXD container run inside the same kernel as the host but have separated network, users, file system etc. LXD can thus only run Linux processes.

KVM is instead a virtual machine technology. It runs a full operating system inside some virtualized hardware. This OS can be Linux but can also be Windows or other OS. The processes then run inside this new OS on the virtualized hardware.

KVM thus provides more separation - both between a VPS and the host and also between different VPS on the same host. A bug in the complex Linux kernel might allow for a LXD processes to break out of the separation. With KVM instead a bug in the far less complex hardware virtualization layer is needed to escape from the virtual machine. Note that both kind of bugs have existed in the past.

... doesn’t make sense from a privacy perspective.

The differences between these technologies is not about privacy. None of these technologies actually provide privacy by their own.

| improve this answer | |
  • Thanks Steffen! Perhaps it isn’t possible to answer my question given how different the attack surface are, but is one considered more secure by the security community and, if so, why? For example, if I was setting up VPS infrastructure for clients with sensitive use cases, would one virtualization platform be more suited than the other? – sunknudsen Aug 1 at 10:26
  • 1
    @sunknudsen: Since KVM provides more separation it means that the attack surface is smaller and the security is better. – Steffen Ullrich Aug 1 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.