Is LXD virtualization as isolated and secure as KVM virtual machines?

Question

Stumbled upon a privacy conscious hosting provider that uses LXD vs KVM to manage user VPS instances.

My understanding is KVM is more isolated so using LXD doesn’t make sense from a privacy perspective.

Perhaps I am missing something?

Answer 1

LXD is at the time of the answer¹ a container technology. It uses Linux namespaces, i.e. the processes inside an LXD container run inside the same kernel as the host but have separated network, users, file system etc. LXD can thus only run Linux processes.

KVM is instead a virtual machine technology. It runs a full operating system inside some virtualized hardware. This OS can be Linux but can also be Windows or other OS. The processes then run inside this new OS on the virtualized hardware.

KVM thus provides more separation - both between a VPS and the host and also between different VPS on the same host. A bug in the complex Linux kernel might allow for a LXD processes to break out of the separation. With KVM instead a bug in the far less complex hardware virtualization layer is needed to escape from the virtual machine. Note that both kind of bugs have existed in the past.

... doesn’t make sense from a privacy perspective.

The differences between these technologies is not about privacy. None of these technologies actually provide privacy by their own.

---

¹ With version 4.0 LXD can also be used to manage virtual machines in addition to containers, i.e. it can make use of KVM+qemu. This answer here is about the original LXD which was only used to manage LXC containers. So this answer is basically comparing container with VM.