3.1.4 Containerization & Virtualization

Containerization and virtualization are essential architectural methods used to isolate applications, services, and entire operating systems from the underlying physical hardware.

Virtualization Concepts Virtualization uses software to create a simulated layer over physical hardware, allowing multiple independent instances to run on a single machine. - Hypervisor: The software that creates and manages virtual machines (VMs). - Type 1 Hypervisor: Also called "bare metal," it runs directly on the hardware (e.g., VMware ESXi, Microsoft Hyper-V). - Type 2 Hypervisor: Runs as an application on top of an existing host operating system (e.g., Oracle VirtualBox, VMware Workstation). - Virtual Machine (VM): A full emulation of a computer system, including its own kernel, OS, and drivers. - Snapshot: A point-in-time "image" of a VM’s state, used for quick recovery or testing patches. - VM Escape: A critical security vulnerability where an attacker breaks out of the VM to access the host hypervisor or other VMs.

Containerization Containerization is a lightweight alternative to virtualization that isolates applications at the process level rather than the OS level. - Containers: These packages include only the application and its dependencies (libraries, binaries), sharing the host’s OS kernel. - Docker: The most common platform for creating and running containers. - Kubernetes: An orchestration tool used to manage, scale, and deploy large numbers of containers across a cluster. - Efficiency: Containers are smaller and faster to boot than VMs because they do not require a guest OS. - Microservices: An architectural style where a large application is broken down into small, modular containerized services.

Secure Infrastructure Design Security+ focuses on how these technologies enable modern security frameworks and resilience. - Infrastructure as Code (IaC): Managing and provisioning infrastructure through machine-readable definition files rather than manual configuration, ensuring consistency and preventing configuration drift. - Immutable Infrastructure: A security practice where components are replaced rather than updated; if a server or container needs a change, a new one is deployed from a known-good image and the old one is destroyed. - Sandboxing: Using VMs or containers to isolate untrusted code from the rest of the network to prevent malware spread.

Quick recall - VM vs. Container: VMs isolate the hardware/OS; Containers isolate the application/process. - Resource Heavy: Virtual Machines (due to guest OS overhead). - Resource Light: Containers (shared kernel). - VM Sprawl: The uncontrolled proliferation of VMs, leading to security gaps and unpatched systems. - Trigger: If the scenario mentions "sharing the host kernel," it is Containerization. - Trigger: If it mentions "Bare Metal," it is a Type 1 Hypervisor.