Re: Capabilities, Anybody?

On Thu, 14 Mar 2024 22:14:57 +0000, MitchAlsup1 wrote:

Lawrence D'Oliveiro wrote:
 

On Thu, 14 Mar 2024 00:11:55 GMT, Scott Lurndal wrote:

 

The architectural features supporting virtualization are designed to
isolate guests from both the hypervisor and other guests.

 

Providing an entire separate kernel for each VM is often unnecessary.
If you need separation at the level of entire subsystems, as opposed to
individual processes, then that’s what containers are for.

 
If you are running k Linuxes under a single HyperVisor, you should be
able to share all the Linux code after giving each of them their own VaS
for data.

Unnecessary to set up complete separation only to poke holes (particularly
big holes) in it to share stuff. Simpler just to create a separation setup
that only separates what needs to be separate.