Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I am migrating to a new server. The old one ran 10.04 as host system and a few more 10.04 and Debian 6 as KVM guests. This was alright, because the processor had support for virtualization. Performance was acceptable. Memory was the bottleneck resource for this case.

On the new server I have more RAM, bigger disks, better CPU and I think it wouldn't be a problem to tackle the load (a load that the old one could take without problem). However, I would now like to split the guests into some with a shallow lxc based jail and some with the full virtualization under KVM/libvirt, providing me more confidence (security-wise) than chroot, but bigger performance than libvirt/kvm at the cost of security drawbacks.

Some of the guests will have their IPs (v4 and v6) "directly" exposed to the Internet (at least or two of the web servers), while others provide services only to the "intranet". There will also be one nginx instance which acts as a frontend to several web servers that don't get directly exposed. Should this be the guiding factor, though? The fact whether or not the guests are "web-facing"?

My main concern is security followed by performance.

The question: What are the facets to consider when deciding which one goes into an LXC jail and which one becomes a full KVM guest?

share|improve this question
Do you really consider necessary to use any KVM implementation? AFAIK lxc runs on the exactly same HW as the host system so it will be running like if it were a host too. – martinc Mar 28 '14 at 2:28
However, until about a few weeks ago the separation wasn't as complete as I consider ideal for my requirements. – 0xC0000022L Mar 28 '14 at 17:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.