Can the root user break out of an OpenVZ container?

[isparks_curtis]

Can anyone tell me if OpenVZ offers any protection for the host node from a malicious user that has root access to a container?

Below is a thread regarding LXC that suggests that with LXC, containers do not provide much protection, but that's LXC...

http://blog.flameeyes.eu/2010/06/22/lxc-and-why-it-s-not-prime-time-yet

...but, I have not been able to find anyone talking about this subject for OpenVZ.

I guess my real question is whether anyone is aware of any exploits that would allow root users to break out of an OpenVZ container and access files on the root host node or other containers?

Or, can anyone share any success stories of giving customers root access to containers? I see there are plenty of hosting companies selling OpenVZ containers with root access... I suppose I could take that as my answer, but I've yet to find an article that explains why OpenVZ is more secure than LXC or even chroot...

I tried to ask this question on the OpenVZ forum recently, and it seems nobody over there cares about this.

Thanks,

Curtis

 

[dietmar]

I guess my real question is whether anyone is aware of any exploits that would allow root users to break out of an OpenVZ container and access files on the root host node or other containers?

I am not aware of such exploits.

 

[isparks_curtis]

That's great news... I've seen some describe OpenVZ as a glorified chroot (which apparently is exploitable http://www.bpfh.net/simes/computing/chroot-break.html), so that's great to hear that OpenVZ is more secure than chroot.

Curtis