Fast Track to Solaris 10 Adoption: Solaris Grid Containers

Please click on a question below or download a pdf version.

1. Security and usability are said to be inversely proportional. Containers add security and isolation, but also complexity. What do you see as the "killer app" or ideal use for containers, where the benefits outweigh the complexity?
2. If a user logs into a non-global zone, is there any way for that user to zlogin to the global zone?
3. What is the process for applying patches when zones are in use?
4. In the grid containers, will this integrate with Oracle, or do you have your own software solution?
5. What's the advantage of using containers compared to using domains? Can we run multiple containers under each domain?
6. Would Solaris Grid and Grid Provisioning be a good grid solution for popping Fortran jobs on a set of racked 1U slaves to run? Would Solaris Grid not be needed in this case, just the Grid Provisioning part?
7. Can containers be spread across multiple nodes in a single cluster, but still have a single global container?
8. What is the best way to backup a zone? Should a backup client be installed per zone, or should it be done globally at /zone/1, /zone/2 etc?
9. What would be the best practice for patching a server that's running zones? Would you have to stop all non-global zones first?
10. Is there a way to quickly re-provision/move a zone?
11. If I forget the root password, how can I recover it?
12. Is Solaris Grid Container administration done via the command line or GUI?

Back to top

Q: Security and usability are said to be inversely proportional. Containers add security and isolation, but also complexity. What do you see as the "killer app" or ideal use for containers, where the benefits outweigh the complexity?

A: We've identified a number of possible uses: traditional data center server consolidation (databases, etc.), Web hosting, developer use (dividing development from production, or allowing developers to share machines), etc. There are already lots of folks doing server consolidation simply using resource management due to concerns over hardware and administrative costs. The idea behind containers is to make this easier.

Back to top

Q: If a user logs into a non-global zone, is there any way for that user to zlogin to the global zone?

A: No, any access to the global zone must be through network services (e.g., ssh). If those services are disabled (or the non-global zone has no network interface) then there will be no way to go from the non-global zone to the global zone.

Back to top

Q: What is the process for applying patches when zones are in use?

A: For OS or Solaris OS patches, the procedure will be to apply the patch from the global zone, and the patch tools will automatically upgrade all the zones on the system. For unbundled software installed in a zone, the procedure will be to apply the patch within the zone itself.

Back to top

Q: In the grid containers, will this integrate with Oracle, or do you have your own software solution?

A: Assuming you're talking about the Oracle database software, existing software should run unmodified in a container (a number of Solaris Express customers have verified this).

Back to top

Q: What's the advantage of using containers compared to using domains? Can we run multiple containers under each domain?

A: Domains partition the physical hardware to run separate OS instances, while containers allow multiple applications to share a single OS instance while still remaining isolated. Yes, you can run multiple containers in each domain.

Back to top

Q: Would Solaris Grid and Grid Provisioning be a good grid solution for popping Fortran jobs on a set of racked 1U slaves to run? Would Solaris Grid not be needed in this case, just the Grid Provisioning part?

A: Containers are useful when there's a need to isolate multiple applications running on the same system, either in terms of resource requirements or configuration, security, namespace, etc. Generally, I'd expect HPC or compute-intensive Fortran apps to have significant resource requirements, but not necessarily to need the namespace isolation. I'd suggest looking at your app's requirements and figuring out what works best for you.

Back to top

Q: Can containers be spread across multiple nodes in a single cluster, but still have a single global container?

A: Sort of. With the Sun Cluster software, you'll be able to associate a clustered application with a container, and that application will run within that container regardless of which node it is running on. You'll still need to configure the containers on each node (though we may be providing software to make that easy).

Back to top

Q: What is the best way to backup a zone? Should a backup client be installed per zone, or should it be done globally at /zone/1, /zone/2 etc?

A: It's really up to you. We think either method is OK; it just depends on your needs.

Back to top

Q: What would be the best practice for patching a server that's running zones? Would you have to stop all non-global zones first?

A: Certain patches (such as the Kernel Update) will require the zones to be shutdown, but most will not. For Solaris patches (as opposed to unbundled and layered products), the procedure will be to apply the patch in the global zone, and all zones that have been installed will have the patch applied to them automatically.

Back to top

Q: Is there a way to quickly re-provision/move a zone?

A: Initially, zones will need to be uninstalled and then reinstalled in the other location, but we realize this is inconvenient and are working to improve the situation going forward.

Back to top

Q: If I forget the root password, how can I recover it?

A: Recovering isn't usually possible, but you can reset it. Boot from CDROM or over the net. Instead of allowing the installer to proceed, pull up a terminal window. Mount the root disk (usually mount /dev/dsk/c0t0d0s0 /a), then go to /a/etc and blank out the password part of root's password in the shadow file.

Back to top

Q: Is Solaris Grid Container administration done via the command line or GUI?

A: Currently Solaris Grid Containers administration is via command line; a GUI option is planned for a future release.

Back to top