Virtualization and isolation

Each container is a separate entity, and behaves largely as a physical server would. Each has its own: Files, Users and groups, Process tree, Network, Devices, IPC objects.

Network

The OpenVZ network virtualization layer is designed to isolate containers from each other and from the physical network. VMs are protected from each other in the way that makes traffic snooping impossible.

Operating System

A container looks and behaves like a regular Linux system. It has standard startup scripts, software from vendors can run inside a container without OpenVZ-specific modifications or adjustment.

Resource Management

Resource management controls the amount of resources available for containers. The controlled resources include such parameters as CPU power, disk space, a set of memory-related parameters, etc.

IP address

Each container has its own IP address

multiple IP addresses per container are allowed.

Firewall and Security

It is possible to set up firewall rules from inside a container (the user can create rules limiting access to some services using the canonical iptables tool inside a container).