3.1c 1 virtualization and containers

Centralized architecture

Management and security consolidated to one console. Better visibility and consolidated logs, but a single point of failure with scaling pressure on storage and CPU.

Decentralized architecture

Multiple sites, providers, and operating systems managed separately. No single failure point, but inconsistent and hard to monitor.

Virtualization

Hypervisor abstracts hardware so multiple VMs, each with its own guest OS, share one physical host.

Hypervisor

Software layer that allocates physical resources among virtual machines.

Guest operating system

The full OS installed inside each virtual machine, separate from every other VM on the host.

Type 1 hypervisor (bare metal)

Runs directly on hardware. Smaller attack surface, used in datacenters. Examples: VMware ESXi, Microsoft Hyper-V.

Type 2 hypervisor (hosted)

Runs as an application on top of an existing OS, inheriting that host OS's vulnerabilities. Examples: VirtualBox, VMware Workstation.

VM escape

Attack breaking out of a guest VM into the hypervisor or other virtual machines on the host.

VM sprawl

Unmanaged, unpatched, undocumented VMs proliferating because they are trivial to create.

Containerization

Applications packaged with their dependencies, all sharing one host OS kernel. Lighter and faster to start than VMs.

Docker

The most widely used containerization platform.

Container escape

Attack breaking out of a container to the shared host OS, affecting every container on that host.

Containers vs VMs isolation

Containers share the host kernel so isolation is weaker; VMs have separate guest OSes so isolation is stronger. Containers = efficiency, VMs = isolation.

Container OS limitation

All containers on a host share that host's OS, so Windows apps and Linux apps require separate container hosts.