GSoC Ideas: Difference between revisions

From Linix VServer
Jump to navigationJump to search
imported>Bertl
imported>Glenn
(catchg)
 
(2 intermediate revisions by one other user not shown)
Line 19: Line 19:
=== iptables proxy and policy daemon ===
=== iptables proxy and policy daemon ===


Kernelside proxy, Userspace policy daemon
''Kernelside proxy, Userspace policy daemon''
 
Linux-VServer uses IP Isolation, so things like iptables cannot be allowed
inside a guest without applying some sanity checks and general host policy.
 
Part of this is a kernel side proxy mechanism, which will relay the netlink
commands issued from e.g. iptables inside a guest to a policy daemon running
on the host.
 
The other part is the policy daemon which has to check the requests for
plausibility, and if applicable implement them in a way which doesn't harm
the host or other guests (e.g. on a separate chain).


=== hard limits for CFS scheduler ===
=== hard limits for CFS scheduler ===


Kernel modification (target upstream)
''Kernel modification (target upstream)''
 
Linux-VServer implements a Token Bucket (TB) scheduler extension which
sits ontop of the Linux scheduler able to limit the CPU resources on
a per guest basis.
 
Recent Linux provides a Completely Fair Scheduler (CFS) which is missing
a hard limit feature, which should be implemented in way that mainline
(kernel.org) can make use of it.
 
[[Category:Ideas]]

Latest revision as of 19:34, 21 October 2011

Google Summer of Code Ideas[edit]

Minimalistic Web Frontend[edit]

Userspace, php or similar

Web Frontend or Framework to do basic administrational tasks like

  • creating and destroying guests
  • starting and stopping guests
  • monitor status and resources

libvirt Integration and Testing[edit]

Userspace, scripting, testing

preliminary work exists, probably needs to be adapted to recent versions and integrated with the libvirt folks.

iptables proxy and policy daemon[edit]

Kernelside proxy, Userspace policy daemon

Linux-VServer uses IP Isolation, so things like iptables cannot be allowed inside a guest without applying some sanity checks and general host policy.

Part of this is a kernel side proxy mechanism, which will relay the netlink commands issued from e.g. iptables inside a guest to a policy daemon running on the host.

The other part is the policy daemon which has to check the requests for plausibility, and if applicable implement them in a way which doesn't harm the host or other guests (e.g. on a separate chain).

hard limits for CFS scheduler[edit]

Kernel modification (target upstream)

Linux-VServer implements a Token Bucket (TB) scheduler extension which sits ontop of the Linux scheduler able to limit the CPU resources on a per guest basis.

Recent Linux provides a Completely Fair Scheduler (CFS) which is missing a hard limit feature, which should be implemented in way that mainline (kernel.org) can make use of it.