0

From my understanding, we use VMs for isolation of environments, so that one environment's configurations does not break another environment. It's all nice, however:

  • It's expensive in terms of performance
  • It takes much storage
  • It introduces complexity

So, if our main issue was isolation of environments, isn't that something that is problematic because of the way how operating systems work? Aren't virtual machines just a workaround for the fact that it's so easy to break things on an OS, making applications unusable? With such a big performance cost, wouldn't it be better to actually come up with a better operating system that actually has built-in isolation of environments?

I think that Docker saw that and that's why they came up with containers - but, as I understand, it's just another workaround (but done with less performance cost).

Am I missing something? Why aren't OSs just done in a way that virtualization wouldn't be needed?

*I know that VMs can also be used just for experimenting, to check some other OS, but I'm rather talking about servers scenarios where each VM is a seperate server.

closed as primarily opinion-based by Ramhound, slhck, Keltari, music2myear, LotPings Mar 5 at 12:07

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • "wouldn't it be better t oactually come up with better operating system that actually has built-in isolation of environments?" Sure. And if it were easy (or economical, or possible) someone would have done it. In fact, as I understand it, some mainframe OS' actually did. Apart from that, virtualization is valuable for other reasons ... the ability to supply fully configured "machines" on demand, the ability to move a VM from one physical host to another quickly and easily, etc. – Steve Rindsberg Mar 3 at 18:15
  • This seems more like an open-ended discussion rather than something that can be easily answered in a single post. As you have observed, there are solutions for everyone's needs, and your premise that in a "normal" OS, environments break each other, is not always the case. – slhck Mar 3 at 18:15
2

From my understanding, we use VMs for isolation of environments

That's correct.

… so that one environment's configurations does not break another environment.

That's too narrow. Isolation is about security in a broad sense: confidentiality, integrity, and availability.

  • Confidentiality: isolation provides fine-grained permission management. VMs and Docker container can only access data and other services you explicitly let them access.
  • Integrity: services themselves can be decoupled from logical and physical storage mechanisms.
  • Availability: Individual services can be reconfigured, updated and restarted independently from each other. Crash of one service doesn't affect other ones. Resource management is also more flexible: you can split one physical machine's resources across many services and manage allocated resources on the fly. Doing this on actual hardware isn't that easy, you can't hot-swap a CPU to a more powerful one (or less powerful one, if you want to allocate more resources to another service).

With such a big performance cost, wouldn't it be better to actually come up with a better operating system that actually has built-in isolation of environments?

Modern CPUs support virtualization, for example look up VT-x available in Intel CPUs. It lets CPU run virtual machines without any performance impact.

And actually...

Docker saw that and that's why they came up with containers

Docker doesn't implement containers, it only uses containerization features provided by the host OS. It's just a convenient way of configuring them to work together and to share pre-built service images. To name just a few OS-provided features, on Linux Docker uses overlayfs, cgroups and iptables. You can use all of these without installing docker. So Linux has built-in isolation of environments, Docker just makes it easy to use.

It may be worth to mention Android here, which, while based on Linux kernel, uses the the ART VM runtime and provides stricter isolation of apps than "regular" GNU/Linux does by default.

Why aren't OSs just done in a way that virtualization wouldn't be needed?

Initially they weren't built with as much isolation in mind and we all got used to this model. While less secure, it's also more comfortable and less cumbersome. It's easier to just let all apps do everything and not manage fine-grained permissions manually. Lack of strict isolation is the reason both for viruses' abilities to do much damage and for MS Word's legit ability to save a document to any folder on your hard disk.

  • Thanks, interesting read – Loreno Mar 4 at 8:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.