Getting to the Bottom of Solaris Containers

IC: What are the differences among Logical Domains, Solaris Zones, and Solaris Containers?

Joost Pronk van Hoogeveen: Domains are a type of hardware partitioning, so the partitioning is done at the hardware level. Solaris Zones are part of Solaris Containers technology. As such, Zones manage the namespace isolation (separate IP addresses and users, for example) for Containers. Containers and Zones are a type of operating system virtualization, where the partitioning is not done at the hardware level, but rather within the operating system itself.

IC: Are Zones and Containers the same thing?

Jeff Victor: Not exactly. The official definition for a Solaris 10 Container is a Solaris Zone using resource management features. But in casual conversation, few people distinguish between Zones and Containers.

IC: Aside from Zones, what else comprises Solaris Containers?

Joost Pronk van Hoogeveen: Solaris Containers are made up of two major components: Solaris Zones and Solaris Resource Manager (SRM). SRM manages the physical system resources every Container receives, and Solaris Zones control the namespace isolation. Together, Zones and SRM form the basis for Solaris Containers.

IC: What distinguishes Solaris Containers from virtual domain technologies, such as LPARs?

Joost Pronk van Hoogeveen: LPARs are a typical virtual machine technology with a hypervisor layer between the hardware and the operating system, whereas Solaris Containers are a type of operating system virtualization. Virtual domains and virtual machines allow different types of operating systems to be run concurrently on the same physical machine. But, as with all virtual machine technologies, there is significant performance overhead to this approach. By contrast, Solaris Containers are very lightweight and create hardly any performance overhead. But Solaris Containers permit only a single operating system version.

IC: What are the relative advantages of Solaris Containers when compared to LPARs?

Jeff Victor: Solaris Containers have a number of advantages, including lower operating system licensing and support costs, lower hardware costs due to better granularity, reduced management workload, and greater application availability.

IC: How do Solaris Containers compare to the virtual machine approach advocated by VMware?

Jeff Victor: Containers provide multiple isolated workload environments with strict security and resource management features. Because there is only one operating system image, the Solaris Containers method is very efficient and reduces management chores. VMware provides the ability to simultaneously host multiple operating system images, as well as the ability to choose different operating system types (Linux, Solaris, and Windows). However, as with all virtual machines, there is a performance penalty with VMware. Also, with VMware and other virtual machine technologies each operating system image must be managed separately.

IC: I have installed Solaris 10 within VMware. Can I use Solaris Containers to virtualize within VMware?

Joost Pronk van Hoogeveen: Yes. Solaris Containers will work within any Solaris 10 instance, so you can evaluate the benefits of operating system virtualization within virtual machines in your particular environment.

IC: With regards to Solaris Zones, what is the global Zone, and are there any local Zones?

Chien-Hua Yen: There are two types of Zones: global Zones and non-global Zones. The official name for a "local" Zone is a "non-global" Zone. A global Zone contains a fully functional installation of the Solaris Operating System that is bootable by the system hardware. So, an installation of the Solaris Operating System becomes the global Zone when it is booted by the system hardware. Only one global Zone runs on a system. Then, the global Zone administrator creates non-global Zones with Zonecfg(1M) and Zoneadm(1M). The global Zone controls the installation, maintenance, operation, and destruction of all non-global Zones.

IC: What is the recommended maximum number of Zones a system can hold, and what are the ease-of-use considerations for a large number of Zones on a single machine?

Chien-Hua Yen: The limiting factors in the maximum number of Zones a server can handle are the amount of memory and disk space available. A Zone can occupy anywhere from ~150MB to 3GB disk space depending on how the Zone is configured. Each Zone also takes some memory for system processes. Still, managing a Zone is very similar to managing a system — except it is easier to manage a Zone because you can patch or backup all Zones using a single command.

IC: Are the physical CPU and RAM shared among Zones? Is it possible to allocate different resources to different Zones?

Jeff Victor: Solaris Zones share CPUs. An administrator can use Solaris Dynamic Resource Pools to assign one or more CPU(s) to a Solaris Zone. Also, the Solaris Fair-Share Scheduler can guarantee that a certain Solaris Zone gets a predetermined minimum amount of processing power. Plus, the Solaris Fair-Share Scheduler helps ensure that CPU power is not wasted because processing resources are only constrained once the system reaches 100 percent utilization. When it comes to RAM, Solaris Zones share the amount of physical memory available on the system. The amount of physical memory that a Zone uses cannot be constrained as it stands now, but Sun is working on a feature that will address this issue soon.

IC: How easy is it to modify resource allocations on a per-Container basis so that resources are more finely managed across all Solaris Containers on a system?

Joost Pronk van Hoogeveen: Resource Management assignments to a Container can be modified at any time without the need for Container reboot. For more information on resource allocation and isolation, check out an in-depth Sun BluePrints article.

IC: With Solaris Containers, what kind of overhead can be expected per CPU (or per core)?

Jeff Victor: For small numbers of Containers, the overhead is hardly measurable — certainly less than 1 percent. A very large configuration with hundreds of Zones sees as much as a 4 percent overhead, which is still very low by comparative standards.

IC: Is it true that if several Zones share the same application, then only one instance of the application needs to be installed? Is there enough isolation so that an error in one instance of the application won't affect the same application in another Zone?

Joost Pronk van Hoogeveen: As for your first question, it is possible for Zones to share the same application instance, but the decision to do so depends on if the administrator is installing the application in a directory that each Zone can see (for example, /usr in Apache). Otherwise each Solaris Zone will require a private copy of the application. With regards to your second question, every application in every Zone has its own instance (and processes) that are totally isolated from one another. Isolation is a prime reason why Sun built Solaris Zones the way it did.

IC: How does patching work? Do I have to patch all the Zones or only the global Zone?

Chien-Hua Yen: For details, check out patchad(1M) or an in-depth article at the Sun BigAdmin portal. In summary, it is possible to patch all Zones from the global Zone or each Zone individually from either the global Zone or the non-global Zone.

IC: Do you need to take down non-global Zones when patching the global Zone?

Chien-Hua Yen: No. It is not necessary to bring down the non-global Zones when patching the global Zone. However, if the job includes a kernel patch, the global Zone will need to be rebooted before the patch takes effect. And, once the global Zone is rebooted, all of the non-global Zones will be brought down.

IC: In the event of a kernel panic, what happens to the Solaris Containers?

Chien-Hua Yen: If the kernel panics, all the Zones go down with it, because there is only one kernel instance supporting all Zones. However, under normal circumstances it is possible to shut down each individual Zone without affecting other Zones. And, if a Zone crashes, the other Zones will not be affected.

IC: Did Sun consider creating a graphic way to configure Containers to make them more user friendly?

Joost Pronk van Hoogeveen: There is a Sun Management Center (Sun MC) add-on called the Solaris Container Manager that is a GUI for managing Containers.

IC: Is it possible to run two or more Containers on one physical server with two or more Oracle database instances running inside each of those Containers? If so, how will the system handle memory management in both Containers and across all Oracle instances?

Joost Pronk van Hoogeveen: Yes. It is possible to create any combination of Oracle databases and Solaris Containers just as if it were a number of database instances on separate machines. And, the Containers will isolate shared memory just as if they were separate machines. Check out this BigAdmin article for more information.

IC: How do ISVs like Oracle and Informix handle license issues when enterprises are using Solaris Containers?

Joost Pronk van Hoogeveen: Sun recommends that database vendors base licensing on the resource pools that are assigned to individual Solaris Containers. So far, Oracle has adopted this policy.

IC: When building processor sets for a Sun Fire T2000 server, does one assign Containers based on the number of processors or the number of threads? In other words, will a four-core (16 thread) chip multithreading chip give me four or 16 "processors" to build sets against?

Joost Pronk van Hoogeveen: On a Sun Fire T2000 server every thread is exposed as a (virtual) CPU. So, the Solaris Resource Manager can create sets on an individual thread basis — meaning all 16 threads are assignable in the example cited.

IC: Are there minimum server size requirements for starting to use Containers? For example, would it be feasible to use Containers on a low-end server such as the SunFire 280R?

Joost Pronk van Hoogeveen: Containers can be installed on any system that supports Solaris 10 — from laptops to high end servers.

IC: Does any tool exist that can verify if an application is Container compliant?

Chien-Hua Yen: Yes. You can download the Solaris Ready Test Suite and also access the Solaris qualification tool. The tool set consists of a DTrace script for checking privileges and device nodes that are not available in a non-global Zone, as well as a source scanning tool for checking the use of non-Zone compliant APIs.