Re: Capabilities, Anybody?

Lawrence D'Oliveiro wrote:

On Thu, 14 Mar 2024 00:11:55 GMT, Scott Lurndal wrote:

The architectural features supporting virtualization are designed to
isolate guests from both the hypervisor and other guests.

Providing an entire separate kernel for each VM is often unnecessary. If you need separation at the level of entire subsystems, as opposed to individual processes, then that’s what containers are for.

If you are running k Linuxes under a single HyperVisor, you should be able
to share all the Linux code after giving each of them their own VaS for data.
Similarly, all library code used by the kernel should be shared uniformly across all users, too {{stdlib, libm, strlib, ...}} where each chunk of
code gets its own static (and global) variables in scope.