Re: Network virtualization/isolation

[Stephen Hemminger <shemminger@osdl.org>]

On Wed, 25 Oct 2006 17:51:28 +0200
Daniel Lezcano <dlezcano@fr.ibm.com> wrote:

> Hi Stephen,
> 
> currently the work to make the container enablement into the kernel is 
> doing good progress. The ipc, pid, utsname and filesystem system 
> ressources are isolated/virtualized relying on the namespaces concept.
> 
> But, there is missing the network virtualization/isolation. Two 
> approaches are proposed: doing the isolation at the layer 2 and at the 
> layer 3.
> 
> The first one instanciate a network device by namespace and add a peer 
> network device into the "root namespace", all the routing ressources are 
>    relative to the namespace. This work is done by Andrey Savochkin from 
> the openvz project.
> 
> The second relies on the routes and associates the network namespace 
> pointer with each route. When the traffic is incoming, the packet 
> follows an input route and retrieve the associated network namespace. 
> When the traffic is outgoing, the packet, identified from the network 
> namespace is coming from, follows only the routes matching the same 
> network namespace. This work is made by me.
> 
> IMHO, we need the two approach, the layer-2 to be able to bring *very* 
> strong isolation for system container with a performance cost and a 
> layer-3 to be able to have good isolation for lightweight container or 
> application container when performances are more important.
> 
> Do you have some suggestions ? What is your point of view on that ?
> 
> Thanks in advance.
> 
>    -- Daniel

Any solution should allow both and it should build on the existing netfilter infrastructure.


-- 
Stephen Hemminger <shemminger@osdl.org>