Currently I am migrating to a new server. The old one ran 10.04 as host system and a few more 10.04 and Debian 6 as KVM guests. This was alright, because the processor had support for virtualization. Performance was acceptable. Memory was the bottleneck resource for this case.
On the new server I have more RAM, bigger disks, better CPU and I think it wouldn't be a problem to tackle the load (a load that the old one could take without problem). However, I would now like to split the guests into some with a shallow
lxc based jail and some with the full virtualization under KVM/
libvirt, providing me more confidence (security-wise) than
chroot, but bigger performance than
kvm at the cost of security drawbacks.
Some of the guests will have their IPs (v4 and v6) "directly" exposed to the Internet (at least or two of the web servers), while others provide services only to the "intranet". There will also be one
nginx instance which acts as a frontend to several web servers that don't get directly exposed. Should this be the guiding factor, though? The fact whether or not the guests are "web-facing"?
My main concern is security followed by performance.
The question: What are the facets to consider when deciding which one goes into an LXC jail and which one becomes a full KVM guest?