Tuesday May 20, 2008

As microprocessors become more powerful, IT organizations looking to increase the efficiency of underutilized servers and simplify administration are starting to explore server virtualization technology. When most people think of server virtualization they think of Type-1 hypervisors popularized by VMware ESX Server. We're also starting to hear more about Xen derived hypervisors that add virtualization capabilities to various Linux distros, NetBSD and Open Solaris. Sun will introduce an Enterprise Class bare-metal hypervisor called xVM Server later this year. These technologies allow individual servers to safely host multiple independent workloads along with complete copies of their host operating systems. Type-1 hypervisors certainly offer a great deal of flexibility and isolation and have the added benefit of supporting diverse guest operating systems e.g Solaris, Linux and Windows simultaneously. However this functionality comes with a cost. The hypervisor software layer itself usually has an associated acquisition and support cost and performance may be degraded compared to running the OS directly on native hardware, especially if the workload is IO intensive. Then there's the administrative and potential licensing costs associated with provisioning, monitoring and maintaining multiple copies of complete operating systems.



Fortunately for Solaris administrators on SPARC and x86 systems there's an alternative - Solaris Containers which were first introduced with Solaris 10's debut in March of 2005. Solaris Containers (a.k.a Zones) are lightweight virtual Solaris instances that look and feel in most respects just like a full Solaris OS instance but which share a single Solaris kernel. Since there is only one real Solaris instance there is only one copy of the Solaris kernel to maintain. Users given shell access to a Solaris Container on the network believe they are running on their own independent server with a unique IP address, independent process address space and their own file system(s) yet may in fact be sharing this same server and a read-only link to common files and directories with dozens or even hundreds of other Solaris Containers. Solaris 10 supports up to 8000 Containers on a single server but this is not a limit I would recommend testing out on your dual-core laptop. In addition, individual Containers can take on a Solaris 8, Solaris 9 or even a Linux personality which simplifies migrating workloads with OS dependencies to Solaris 10.

Solaris Containers are easy to provision, require only a small amount of incremental disk space, and can be rebooted as needed in seconds. Containers can also be cloned, detached, moved and reattached which makes replicating and rehosting Containers onto different physical systems straighforward. Since Containers take advantage of Solaris 10's fine grained privilege features, users or workloads running inside a Container don't have access to the full array of "root" features that might otherwise allow for undesired mischief on a shared production resource. This feature alone makes Containers an interesting production deployment choice even for servers with only a single workload. Should the host Container be compromised an attacker can't for example put a NIC into promiscuous mode or write into kernel address space.

We are already starting to see innovative hosting services take advantage of the low-cost, scalability and security advantages of Solaris 10 by offering Container based Solaris virtual machines. Sun partner Joyent offers a virtual computing infrastructure for Web 2.0 applications starting at just $45 / month. Sun also recently introduced a Solaris on Demand service which enables traditional enterprise ISVs to take their software to market as an Internet based service without the hassle of re-architecting their application for multi-tenant use. Using Solaris Containers these ISVs can securely host various layers of their existing architecture onto one or more SPARC or x86 based servers and then scale their service by adding Containers as new customers come online.

For more information on Solaris Containers, visit Sun.com or use the following Google Search. At last count the search returns about 140,000 pages. I also highly recommend the following Sun Blueprint: Solaris Containers: Virtualization in the Solaris Operating System

Comments:

Post a Comment:
  • HTML Syntax: NOT allowed