Changes

OpenVZ is a virtualization technology for Linux, not unlike Xen, KVM, or VMware. As with other products, it which lets one to partition a single physical Linux machine into multiple smaller virtual machines. The difference is in technology used for partitioningunits called containers.Technically, it consists of three major things:

A namespace is a feature to limit the scope of something. Here, namespaces are used as containers building blocks. A simple care of a namespace is chroot. === Chroot ===[[Image:Chroot.png|right|200px]]Traditional UNIX <code>chroot()</code> system call is used to change the root of the file system of a calling process to a particular directory. That way it limits the scope of file system for the process, so it can only see and access a limited sub tree of files and directories. Chroot is still used for application isolation. For example, running ftpd in a chroot to avoid a potential security breach. === New namespaces === OpenVZ builds on a chroot idea and expands it to everything else that applications have. In contrastother words, every API that kernel provides to applications are "namespaced". Examples include: * File system namespace -- this one is chroot() itself. * PID namespace, so in every container processes have its own unique process IDs, OpenVZ uses and the first process inside a container have a PID of 1 (it is usually /sbin/init process which actually relies on its PID to be 1). Containers can only see their own processes, and they can't see (or access in any way, say by sending a singlesignal) processes in other containers. * IPC namespace, so every container have its own IPC (Inter-Process Communication) shared memory segments, semaphores, and messages. * Networking namespace, so every container have its own network devices, IP addresses, routing rules, firewall (iptables) rules, network caches and so on. * /proc and /sys namespaces, for every container to have their own representation of /proc and /sys --special filesystems used to export some kernel information to applications. In a nutshell, those are subsets of what a host system have. * FIXME moar moar moart == Single kernel approach== Multiple isolated containers are running on top of one single kernel. This is pretty much the same Linux kernel, just with added notion of containers. Basically,  All the containers running on a single piece of hardware share one single Linux kernel. There is only one single OS kernel running, and on top of that there are multiple isolated instances of user-space programs. This  Single kernel approach is much more lightweight light-weight than traditional VM-style virtualization. The consequences are: