Chapter 3 - Questions regarding Virtualization Mechanisms

kaisong

This chapter highlights a few linux virtualization mechanisms. However, without working with them closely, it's hard to understand their subtle difference and how the underlying fundamentals (cgroups, namespaces, and UnionFS) support them.

Unfortunately, the labs don't go into much depth as well. They are mostly creating a container, check the status, then remove it. How they are fundamentally different from each other is not clear to me. For example, I was able to chroot into the systemd-nspwan directory. So, besides I can use machinectl to check the container status, are there any other differences? What can chroot do, that will be prevented by systemd-nspawan or lxc when we are inside the container?

It would be really helpful to use the labs to highlight the differences mentioned in this and the previous chapters. As of now, I seem to understand individual concepts discretely (cgroups, namespaces, UnionFS, creating virtualized environment in linux and get a root bash), but it's not clear how they interact, relate to, and are different from each other.

Can anyone help me to understand the following?

• Are all the virtualization mechanisms use cgroups, namespaces, and UnionFS? From the chapter3 labs, it's hard for me to see the connection. For example, after I chroot into a directory, in the host system, will I see anything in "lscgroup" for cgroup or "ip netns list" for namespace? I am not able to find anything, does it mean these fundamentals are not being used for chroot?
• It was mentioned in chapters that chroot has security concerns of accessing the actual root of the host. How can this be done in the lab? And, how the same thing can not be done in lxc or systemd-nspawn?
• Using the labs, can anyone highlight the core difference of chroot, lxc, and systemd-nspawn beyond simple "create, check status, and remove"? To me, they are more or less the same once you are in the container. The only differences are the commands to manage. This is clearly not the case based on the readings in chapter3.