Over the next few weeks, I will be hosting several Solaris 11 hands on workshops. Some of these will be public events at an Oracle office while others will be private sessions for a specific customer. If you are planning on attending any of these sessions, there are a few items of pre-work that will help us get the workshop started on time.
If you will be using VirtualBox to run your workshop lab guest, the hardware virtualization feature for your CPU must be enabled. For AMD systems, AMD-V is on by default and there may not be a setting to turn it off. For Intel systems, this is controlled by a BIOS setting, and almost always defaults to disabled. The BIOS setting varies from vendor to vendor, but is generally found in the System or CPU settings. If you don't see it there, try looking in security. If you still can't find it, search for your brand of laptop and "enable vt" using your favorite search engine.
On newer Intel systems, you may be given choices for CPU virtualization (VT-x) and data/IO (VT-d). You only need to enable VT-x. Some laptops will require a complete power cycle after changing this setting, including removing the battery.
If you have a company laptop that does not allow you to change the BIOS settings, you might ask your employer if they can provide you one for the day that is not locked down.
Note: Enabling hardware virtualization is a requirement to complete the workshop.
Download and Install VirtualBox
Since this will be primarily a hands on lab, you are encouraged to bring a laptop. The labs will all be run in a Solaris guest machine, so your laptop will also need a virtualization application, such as VMware or VirtualBox. We recommend VirtualBox and will be supplying the lab materials as a VirtualBox guest appliance. You can download VirtualBox for free at VirtualBox.org. Binaries are available for Windows, MacOS, Solaris and most Linux distributions.
After installing VirtualBox, you should also install the VirtualBox Extensions Pack. These are not required for the lab, but should you continue to use the guest machine after the workshop, you might find some of the features very useful.
Don't Forget Your Power Adapters
Since you will be running Solaris as a guest operating system, your host power management features might not very effective and you may find yourself with a drained battery before the morning is over. Please remember to bring your power adapter and cables. An external mouse, while not required, is generally a welcome device, as you cut and paste text between windows.
That should be about it. Please leave a comment if you have any questions. I am looking forward to seeing you at one of these, or a future Solaris event.
An often asked question, do I put my application in a container (zone) or an LDOM ? My
question in reply is why the or ? The two technologies are not mutually
exclusive, and in practice their combination can yield some very interesting
results. So if it is not an or, under what circumstances would I apply
each of the technologies ? And does it matter if I substitute LDOMs with
VMware, Xen, VirtualBox or Dynamic System Domains ? In this context all virtual machine
technologies are similar enough to treat them as a class, so we will generalize to
zones vs virtual machines for the rest of this discussion.
First to the question of zones. All applications in Solaris 10 and later
should be deployed in zones with the following exceptions
The restricted set of privileges in a zone will not allow the application to operate correctly
The application interacts with the kernel in an intimate fashion (reads or writes kernel data)
The application loads or unloads kernel modules
There is a higher level virtualization or abstraction technology in use that would obviate any
benefits from deploying the application in a zone
Presented a different way, if the security model allows the application to run and you aren't
diminishing the benefits of a zone, deploy in a zone.
Some examples of applications that have difficulty with the restrictive privileges would be security
monitoring and auditing, hardware monitoring, storage (volume) management software, specialized
file systems, some forms of application monitoring, intrusive debugging and inspection
tools that use the kernel facilities such as the DTrace FBT provider. With the introduction
of configurable zone privileges
in Solaris 10 11/06, the number of applications that fit into this category should be few in
number, highly specialized and not the type of application that you would want to deploy in a zone.
For the higher level abstraction exclusion, think of something at the application layer that tries to hide the
underlying platform. The best example would be Oracle RAC. RAC abstracts the details of the platform
so that it can provide continuously operating database services. It also has the characteristic that it
is itself a consolidation platform with some notion of resource controls. Given the complexity associated
with RAC, it would not be a good idea to consolidate non-RAC workloads on a RAC cluster. And since zones
are all about consolidation, RAC would trump zones in this case.
There are other examples such as load balancers and transaction monitors. These are typically
deployed on smaller horizontally scalable servers to provide greater bandwidth or increases service
availability. Although they do not provide consolidation
services, their sophisticated availability features might not interact well with the
nonglobal zone restrictive security model. High availability frameworks such as SunCluster
do work well with zones. Zones abstract applications in such a way that
service failover configurations can be significantly simplified.
Unless your application falls under one of these exemptions, the application should be deployed
in a zone.
What about virtual machines ? This type of abstraction is happening at a much lower level, in this
case hardware resources (processors, memory, I/O). In contrast, zones abstract user space
objects (processes, network stacks, resource controls). Virtual machines allow greater flexibility in running
many types and versions of operating systems and applications but also eliminates many opportunities
to share resources efficiently.
Where would I use virtual machines ? Where you need the diversity of multiple operating systems.
This can be different types of operating system (Windows, Linux, Solaris) or different
versions or patch levels of the same operating system. The challenge here is that large sites can
have servers at many different patch and update versions, not by design but as a result
of inadequate patching and maintenance tools. Enterprise patch management tools
patch managers (PCA), or
automated provisioning tools (OpsWare) can help reduce the number
of software combinations and online maintenance using Live Upgrade can reduce the time and effort
required to maintain systems.
It is important to understand that zones are not virtual machines. Their differences and the
implications of this
Zones provide application isolation on a shared kernel
Zones share resources very efficiently (shared libraries, system caches, storage)
Zones have a configurable and restricted set of privileges
Zones allow for easy application of resource controls even in a complex dynamic application environment
Virtual machines provide relatively complete isolation between operating systems
Virtual machines allow consolidation of many types and versions of operating systems
Although virtual machines may allow oversubscription of resources, they provide very few opportunities
to share critical resources
An operating system running in a virtual machine can still isolate applications using zones.
And it is that last point that carries this conversation a bit farther. If the decision between zones and
virtual machines isn't an or, under what conditions would it be an and, and what sort of benefit can
be expected ?
Consider the case of application consolidation. Suppose you have three applications: A, B and C.
If they are consolidated without isolation then system maintenance becomes cumbersome as you can
only patch or upgrade when all three application owners agree. Even more challenging is the
time pressure to certify the newly patched or upgraded environment due to the fact that you have
to test three things instead of one. Clearly isolation is a benefit in this case, and it is a
persistent property (once isolated, forever isolated).
Isolation using zones alone will be very
efficient but there will be times when the common shared kernel will be inconvenient - approaching
the problems of the non-isolated case. Isolation using virtual machines is simple and very flexible
but comes with a cost that might be unnecessary.
So why not do both ?
Use zones to isolate the applications and use virtual machines for those times when you cannot
support all of the applications with a common version of the operating system. In other words
the isolation is a persistent property and the need for heterogeneous operating systems is
temporary and specific. With some small improvements in the patching and upgrade tools,
the time frame when you need heterogeneous operating systems can be reduced.
Using our three applications as an example, A B and C are deployed in separate zones on
a single system image, bare metal or in a virtual machine. Everything is operating
spectacularly until a new OS upgrade is available which provides some important new
functionality for application A. So application owner A wants to upgrade immediately,
application B doesn't care one way or the other, and (naturally) application C has
just gone into seasonal lock-down and cannot be altered for the rest of the year.
Using zones and virtual machines provides a unique solution. Provision a
new virtual machine with the new operating system software, either on the same platform
by reassigning resources (CPU, memory) or on a separate platform. Next clone the zone
running application A. Detach the newly cloned zone and migrate it to the new virtual machine.
A new feature in Solaris 10 10/08 will automatically upgrade the new zone upon attachment
to a server running newer software. Leave the original zone alone for some period of time
in the event that an adverse regression appears that would force you to revert to the
original version. Eventually the original zone can be reclaimed, but at a time when convenient.
Migrate the other two applications at a convenient time using the same procedure. When
all of the applications have been migrated and you are comfortable that they have been
adequately tested, the old system image can be shut down and any remaining resources
can be reclaimed for other purposes. Zones as the sole isolation agent cannot do this
and virtual machines by themselves will require more administrative effort and higher
resource consumption during the long periods when you don't need different versions of
the operating system. Combined you get the best of both features.
A less obvious example is ISV licensing. Consider the case of Oracle. Our friends at
Oracle consider the combination
of zones and capped resource controls as a hard partition method which allows you to
license their software to the size of the resource cap, not the server. If you put Oracle
in a zone on a 16 core system with a resource cap of 2 cores, you only pay for 2 cores.
They have also made similar considerations for their Xen based Oracle VM product yet have
been slow to respond to other virtual machine technologies. Zones to the rescue. If you
deploy Oracle in a VM on a 16 core server you pay for all 16 cores. If you put that same
application in a zone, in the same VM but cap the zone at 4 cores then you only pay for
Zones are all about isolation and application of resouce controls. Virtual machines
are all about heterogeneous operating systems. Use zones to persistently isolate applications.
Use virtual machines during the times when a single operating system version is not
This is only the beginning of the conversation. A new Blueprint
based on measured results from some more interesting use cases is clearly needed. Jeff Savit,
Jeff Victor and I will be working on this over the next few weeks and I'm sure
that we will be blogging with partial results as they become available. As always, questions and
suggestions are welcome.
I've had a great time traveling around the country talking about Solaris. It's not exactly a difficult thing - there's plenty to
talk about. Many of you have asked for copies of the latest Solaris update, virtualization overview and ZFS deep dive. Rather than have you dig through a bunch of old blog entries about bootcamps from 2005, here they are for your convenience.
Bob Netherton is a Principal Sales Consultant for the North American Commercial Hardware group, specializing in Solaris, Virtualization and Engineered Systems. Bob is also a contributing author of Solaris 10 Virtualization Essentials.
This blog will contain information about all three, but primarily focused on topics for Solaris system administrators.