[regecks]

Er, seems odd to be using OpenVZ if security/hardening is what you're after.

The shared kernel is a larger attack surface compared to KVM or Xen, and the OpenVZ host admin can easily see/manipulate your running processes.

No hate for OpenVZ though, I've used it constantly for about 4 years, but it makes me nervous when its discussed in a multi-tenant context.

[feld]

Why do you think a shared kernel is somehow more secure than a hypervisor?

[regecks]

Me? My point was that HV/PV virtualization is likely to be more secure than OpenVZ, sorry if it was unclear.

[joshbaptiste]

ah indeed.. security isn't my focus on those nodes, running a couple of test server applications.