Is openVZ patched against all exploits for its current kernel version?

Question

I am looking for a container vitalization software that will allow me to create containers that will house specific software/jobs/tasks which I can start stop at will (and bind to interface aliases). The containers will house actual users as well as specific servers for such entities like video games.

I have a few different pieces of software I am considering at the moment which are FreeBSD jails (which I have yet to get working inside a VM), and openVZ (which I have currently working), and maybe a full virtualization platform like KVM (which I haven't used at all).

Anyways, my first question is... since I noticed that openVZ is using the 2.6.32 kernel (which has known local root and other exploits), is the openVZ version of this kernel up to date with patches? If not would I be better off using FreeBSD jails, or other software like KVM on a more up to date kernel?

My second question is... if openVZ is not fully patched because of its old kernel, is there a way to use a updated kernel with the openVZ containers? I am using Debian wheezy 3.2.0-4 as my host node kernel if it matters at all (even though openVZ replaces the kernel).

And my list question (although unrelated to openVZ itself)... with software like KVM is it straight forward to create a virtual machine and bind it to a specific IP alias like in openVZ? I know FreeBSD jails and openVZ can only create Linux containers as they share their kernel with their containers, but KVM allows for full virtualization of other OS platforms like windows which is something I may look into in the future.

Thanks for your time and answers.

Answer 1

Just take a look at OpenVZ kernel changelogs -- there are regular (up to a few times per month) kernel releases, often with CVE fixes. Also, it's not 2.6.32 -- it's RHEL6 (which was based on 2.6.32 but moved forward a lot).

Answer 2

I found some related news that hopefully confirms that openvz does in fact apply patches to their kernel as they come out:

The OpenVZ kernel is based on the Linux kernel. The OpenVZ team tracks and analyzes all the security updates to the Linux kernel and applies them accordingly.

To achieve the maximum possible security and stability, stable OpenVZ kernels are based on Red Hat Enterprise Linux kernels, which are conservative and well-maintained. By using an enterprise kernel as a base (rather than latest vanilla kernel), we avoid adding new bugs or security holes, still the old ones are getting discovered and fixed, and the kernel matures.