<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 21, 2016 at 12:14 PM, R P Herrold <span dir="ltr"><<a href="mailto:herrold@owlriver.com" target="_blank">herrold@owlriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Tue, 21 Jun 2016, Jeff Frontz wrote:<br>
<br>
> My thought is to run the legacy distribution on a VM (say, under kvm)<br>
> inside another instance of a more modern distribution -- using the<br>
> encapsulating host's security to protect the legacy instance from the<br>
> outside world. The only access to the legacy instance would be from the<br>
> modern instance (an encapsulating bastion host, if you will).<br>
<br>
</span>nested containers are trickier than simeply running two<br>
instances, with the second accessible only across a non-routed<br>
backside network. Pmman is set up to permit the end user to<br>
disable and optionally re-enable the 'front side' routed<br>
network, and each machine gets an isolated appearance on a<br>
backside '10.x.x.n/24 network<br></blockquote><div><br></div><div>I'm not sure I follow-- are you saying that the tricky part is having to deal with instantiating/using a non-routed host-encapsulated network? I'm fine with requiring all access to be on/via the bastion host (e.g., ssh/scp in to bastion, then ssh/scp into legacy via "local"/hosted network instance).</div><div><br></div></div></div></div>