Changes
→Requirements
== Approaches ==
=== Virtualization on the 2nd level (OpenVZ) ===
The main requirement is that containers should have close to standalone servers networking capabilities. In details:
For input packets context switching is performed in netif_receive_skb(), inherited from the device context. For output, context is inherited from the socket one.
=== Virtualization on the 3d level (IBM) ===
# The source address will be filled with the container IP address;
# Keep sockets isolated by namespace;
# have broadcast and multicast working.
For input packets context switching is inherited from the routing entry, for output - inherited from the socket one.
=== Socket virtualization Sockets isolation (Linux-VServer) === ==== Requirements ==== # all interfaces and IPs are visible on the host# routing and iptables is configured on the host# guest has a subset of IPs assigned for 'binding'# source ip (of guest packets) is within the assigned set# 'Requirements''local':guest traffic is isolated from other guests# implementation no measurable overhead for established tcp connections should be zero;on packet routing# normal routing not impaired (same behaviour as without)# FIXMEGuest-Guest and Guest-Host traffic via Loopback ==== Current implementation ====
Network Context with 'assigned'set of IPs, which are used for 'Current implementationcollision'checks at bindtime, 'source':checks at send time and 'destination' checks at receive time. The firstassigned IPs is handled special as it is used for routing decisions outside the IP set.Loopback traffic isolation is done via IP 'remapping'.
== Virtualization table ==
This is a summary table in order to show which core networking objects are virtualized/isolated in the above approaches or and which are not.
{| class="wikitable"
! width="20%" | Virtualization approach
! width="1310%" | network devices! Width="1310%" | routing tables! Width="1310%" | network sockets! Width="1310%" | loopback! Width="10%" | netfilters
|-
| 2d level virtualization || v || v/i || v || v || v
|-
| 3d level virtualization || - || i || i || i || -
|-
| bind filtering sockets isolation || - || - || i || - || -
|}