Client | Sun Microsystems 10 manual

Version 3.1-enSolaris 10 Container Guide - 3.1 4. Best Practices

Effective: 30/11/2009

administrator. With the software products described here, the requirements with respect to visualization and flexibilization of containers right up to disaster recovery concepts can be covered completely.

	Admin.
Primary Site	Client
Primary Site	Backup Site

Optional Router

Heartbeat DWDM

Network

SE SE

Network Network

FC FC

Switch-8 Switch-8

DWDM	DWDM	SE
		Network
Unlimited Distance		FC
		Switch-8

Separation

9990

9990

9990

Figure 25: [tf/du] Typical configuration: Sun Cluster Geographic Edition

Active	Sun Cluster Geographic	Passive

Sun Cluster		Sun Cluster
Hamburg
		Munich
	Container protection group

Container rg

Container

Agent Applic.

Container

Agent

HAStorage		Logical
Plus		Host

Container rg

Container

Agent Applic.

Container

Agent

HAStorage Logical

Plus Host

Figure 26: [tf/du] Resource groups and protection group topology

The hardware architecture shown above consists of a dual-node cluster made of SF6900 servers in the primary data center and a single-node cluster in the alternative data center designated for disaster recovery. The storage systems used are Sun StorageTek 9990 systems and data replication is done via Truecopy. Control is via Sun Cluster Geographic Edition. If disaster recovery is not desired, each data center can also be operated independently. In the resource group topology shown above, the active cluster manages a container. The passive cluster is used for disaster recovery purposes. The clusters form a partnership and manage the resource groups in a so-called protection group.

48

Image 55

Sun Microsystems 10 manual Client

Contents

Solaris 10 Container Guide Table of contents III Network limitation IPQoS Duplicating zones with zoneadm detach/attach and zfs clone Disclaimer VII Introduction Overview Solaris Containers and Solaris Zones Ug Characteristics of Solaris 10 Zones Zones and security Zones and software installationZones and privileges Fair share scheduler in a resource pool Zones and resource managementCPU resources Processor sets in a resource pool Memory resource management Network resource management IPQoS = IP Quality of ServiceUser interfaces for zones Branded zones Linux and Solaris 8/Solaris 9 compatibility Zones and high availability Solaris container cluster aka zone cluster Virtualization technologies compared Domains/physical partitions App Server Dd Logical partitions Logical partitions Dd Container Solaris zones in an OS Containers Solaris zones in an OS Dd Consolidation in one computer Consolidation in one computer Summary of virtualization technologies Physical Logical Resource Virtualisation Management App Assessment SolutionGrid computing with isolation Requirement Small web servers Global Zone System Dd Use case Multi-network consolidation Multi-network consolidation Dd Use case Multi-network monitoring Multi-network monitoring Dd Use case Multi-network backup Multi-network backup Consolidation development/test/integration/production Dd Use case Consolidation of test systems Consolidation of test systems Requirements Training systems Dd Use case Server consolidation Server consolidation Dd Use case Confidentiality of data and processes Confidentiality of data and processes Dd Use case Developer test systems Test systems for developers Solaris 8 and Solaris 9 containers for development Solaris 8 and Solaris 9 containers as revision systems Dd Use case Hosting for different companies on one computer Hosting for several companies on one computer Da Use case SAP portals in Solaris containers SAP portals in Solaris containers Da Live upgrade Upgrade- and Patch-management in a virtual environment DC1 DC2 Flying zones Service-oriented Solaris server infrastructure Solaris Container Cluster aka zone cluster Whole-root zones ConceptsSparse-root zones − /lib − /platform − /sbin − /usr Whole-root Var Usr Comparison between sparse-root zones and whole-root zonesPlatform ~3.6 GB Software in zones Software installation by the global zone usage in all zones Software installations in Solaris and zones Installation by the local zone usage in the local zone Program/application storage Data storage Opt/staroffice Root disk layoutZFS within a zone Volume manager in local zones Options for using ZFS in local zonesNFS and local zones Ndd -set /dev/ip iprestrictinterzoneloopback Network concepts Introduction into networks and zonesNetwork address management for zones Shared IP instance and routing between zones Firewalls between zones IP filter Exclusive IP instancePlumb, snoop1M, dhcp5 or ipfilter5 is possible Interface = InterfacenameInstance + VLAN-ID Ipmp Zones and limitations in the network Dynamic configuration of devices Static configuration of devices Projects Separate name services in zonesServices Hosts database Applications in local zones only Paradigms Clustered containers One application per zone Client Solaris Container Cluster Configuration and administration Automated provisioning of services Automatic configuration of zones by scriptInstallation and administration of a branded zone Lifecycle management Patching with live upgradePatching a system with local zones Patching with zoneadm attach -u Patching with upgrade serverMoving zones between architectures sun4u/sun4v ∙ create /zones/zone1 Backup and recovery of zones Migration of a zone to another system Backup of zones with ZFSUsing boot arguments in zones Management and monitoring Auditing operations in the zone Consolidating log information of zonesMonitoring zone workload Extended accounting with zones Global# dtrace -n iostart@zonename = count DTrace of processes within a zone General resource pools Resource managementTypes of resource management Capping of CPU time for a zone Projects, projadd, projmod, projdel Lightweight processes LWPFair share scheduler FSS Fair share scheduler in a zone Limiting virtual memory Limiting memory resourcesRcapstat Assessing memory requirements for global and local zones Privileges and resource management Limiting locked memoryNetwork limitation IPQoS IPC limits Semaphore, shared memory, message queues Dd Planning a Solaris container Solaris container navigator Dd Self-qualification of an application in a container 4zonecfgbrand=native Configuration files Installation and configurationDd File /etc/zones/index Command Description Special commands for zones Command Description Metadb SwapVar Var/crash Configuring a sparse root zone required Actions Configuring a whole root zone required Actions Zone initialization with sysidcfg Zone installation Uninstalling a zone Starting zones automatically Optional settingsChanging the set of privileges of a zone Storage within a zone Using a device in a local zone Zone1# ls /dev/dsk C1d0s0 Local zone mounts a UFS file system from a device User level NFS server in a local zone Using a DVD drive in the local zone Version 3.1-enSolaris 10 Container Guide 3.1 5. Cookbooks User attributes for ZFS within a zone Several zones share a file systemZFS in a zone Tank 30.2M 10G 18K None Tank/zone1 16.3M 983M Mnt − zonecfg -z zone -f file Configuring a zone by command file or templateAutomatic quick installation of zones With zonecfg -z zone export -f file of an existing zone Zones hardening Accelerated automatic creation of zones on a ZFS file system Network interfaces for exclusive IP instances Change network configuration for shared IP instancesSet default router for shared IP instance Network Set interceptloopback IP filter between shared IP zones on a system Implementation IP filter between exclusive IP zones on a systemZones, networks and routing Global and local zone with shared network NetworkNetwork Zone 1 /etc/hostname.bge1 Zone 2 /etc/hostname.bge2 Set defrouter=192.168.202.2 Zones in separate networks using the shared IP instanceIfconfig bge1 plumb down Zoneadm -z zone1 ready Zoneadm -z zone2 ready Zonecfg set ip-type=exclusive Zones in separate networks using exclusive IP instancesZone 1 /etc/hostname.bge1 Zone2 192.168.202.1 are now active 192.168.101.201 Zone 1 /etc/hostname.bge1 Zone1 192.168.201.1,192.168.200.1 and zone2192.168.202.1 Zoneadm -z zone1 boot, zoneadm -z zone2 boot Zone 1 /etc/hostname.bge3 /etc/defaultrouter Load Balancer Boot arguments in zones Booting a zoneRoot password for system maintenance control-d to bypass Software installation per mount Zone migration among systems Software installation with provisioning system∙ Detach the zone with zoneadm -z zone detach Global# zoneadm -z test halt Zone migration within a systemGlobal# zoneadm List -vc Global Running Native Shared Test Export/home/zone/test Duplicating zones with zoneadm clone Global Running Native Shared Test Installed Container/test 100 ID Name Status Path Brand 101 Duplicating zones with zoneadm detach/attach and zfs clone 102 Moving a zone between a sun4u and a sun4v system 103 Lumount s10-807+1 Using live upgrade to patch a system with local zonesShutting down a zone Lucreate -c s10-807 -n s10-807+1 -m //dev/dsk/c1t0d0s4ufs 105 Reboot Luactivate s10-807+1 init Zone audit DTrace in a local zoneZone1# dtrace -l tail +2 zone1# Zone accounting Resource pools with processor sets Limiting the /tmp-size within a zoneSwap Tmp Tmpfs Yes Size=250m Limiting the CPU usage of a zone CPU capping 108 Global # svcs dynamic Dynamic resource pools for zones109 110 Limiting the physical main memory consumption of a projectImplementing memory resource management for zones Rcapadm -z zone1 -m 40m Zone.max-swap Privileged 180MB Deny System 16.0EB Max Global # prctl -i zone zone1 Zone 22 zone1111 112 Solaris Container in OpenSolarisOpenSolaris general Ipkg-Branded zones Cookbook Installing an ipkg zone Cookbook Configuring an ipkg zone113 114 References