Slashdot Mirror

← Back to Stories (view on slashdot.org)

Zones are in Solaris Express (Solaris 10)

Posted by CmdrTaco on from the i-want-my-processes-in-the-danger-zone dept.

snoofy writes "Zones, as people from SUN Microsystems have talked about for some time are now available in solaris express (the pre-release of Solaris 10). This will let you virtualize Solaris so that processes run in isolation from other activity on the system... A system can then be configured to run several zones which will make it look like different systems on the network Some info from a posting to comp.unix.solaris. The cool stuff is that it works on both SPARC and x86."

164 comments

  1. Hmmm.... by Anonymous Coward · · Score: 1, Interesting

    Where have I seen this before... Oh that's right, the features Compaq/Hp have been shipping with their Tru64 Alpha Servers for _years_. Good job Sun. http://h18002.www1.hp.com/alphaserver/nextgen/part itions.wmv. ANyone who buys Sparc over Alpha is an idiot. Hell, you can even do this on Linux with UML..sun is playing catchup with just about everyone, but somehow manages to push enough spin on it to make every dumbass journo announce as an amazing technical innovation. http://user-mode-linux.sourceforge.net/. Sorry people, but sun are pushing 20th century technology with some marketing spin to make it sound up to date.

    1. Re:Hmmm.... by GiMP · · Score: 4, Insightful

      That may be so but instead of buying an Alpha, you can run Solaris on x86 hardware. You're also right about UML, but that is probably not as easily configured and certainly not shipped in a ready-made form with a distribution, compared to Sun's solution. Of course, for all the people already commited to Sun, this is a great thing.

    2. Re:Hmmm.... by haggar · · Score: 2, Informative

      Disclaimer: I am not the author of the following post, I took it form here.

      I believe this is not too far from what you can achieve with user mode linux. We've been using similiar technology in unix classess at school using uml.

      There are however few differences:

      1.) Solaris accesses host filesystem, while in user mode linux, you have to provide file or block device with disk image it will use. This is quite bad, because you have to preallocate space for zones. There is a project that aims to allow this, but I don't know how usable is this. You could of course overcome this by doing Root FS on NFS and dhcp and letting the guest os mount host's partition via NFS. This would probably have quite significant performance overhead though :(. Filesystem in filesystem is not very optimal too.

      2.) It is not that easy to setup. This could be done with few scripts. I would love Debian and possibly other distros to have scripts, which would instantly create the zone's filesystem. Preferably, it would allow for some sharing (f.e. creating hard links to original data and kernel would unlink, copy transparently if slave wants to write -- some equivalent of copy on write seen in memory management).

      3.) The networking is not so easy to setup. Could be also part of the script

      4.) Linux does not have so well done resource allocation as Solaris. So the guest kernel should be able to limit itself (f.e. not to use more than 30% of cpu time). Is it possible to do some precise resource allocation under Linux (maybe using some patch to kernel, or something like that?)

      --
      Sigged!
    3. Re:Hmmm.... by Jotaigna · · Score: 4, Insightful

      You have pointed out a critical thing. Marketing. For many year Sun has been succesful in the market because is a reliable brand and quite good.(at least in Chile, of course) its like being "mercedes" or something like that. They have a name and a reputation that helps them a lot. If windows came with a better command line(like xterm) it would be news too!!, and they of course would make shure its news for everyone.

      If we want to make OS software more succesful in the market, we have to come up with marketing schemes for it, they can be as important as good coding.

      --
      "The quality of life is inversely proportional to the number of keys on your keyring."
    4. Re:Hmmm.... by Anonymous Coward · · Score: 0

      Jeezus, if you're going to be a karma whore, you could at least check the post you're stealing for grammatical errors...

    5. Re:Hmmm.... by SirTwitchALot · · Score: 4, Informative

      Well considering that alpha is a discontinued platform I doubt anyone would be smart to buy one. Furthermore, if this technology is the next evolution of containers (which I think it is) it's nothing like what you speak of. You don't need to maintain a seperate os image for each zone, making administration easy. The only problem I've had with containers is isolation, which I hear has improved with zones. Physical partitioning (domains) have been in the sun product line since the 10k. Try understanding the technology before you comment about it... or more likely, IHBT

      --
      Go away, or I will replace you with a very small shell script.
    6. Re:Hmmm.... by Anonymous Coward · · Score: 1, Interesting

      The difference between Alpha Tru64 partitions and Sun Solaris zones is that Tru64 requires dedicated I/O/CPU/Mem resources on per instance basis. This Alpha feature, which quite neat, works for OpenVMS too. But I think I like the Sun's solution better - no hardware resources pre-allocation is required.

      For instance, you can configure two partitions on Alpha, run an OpenVMS image on each of them and to even create a cluster on these two images. In this case if the first image fails for some reason, the second image will still be running cluster processes (given that the quorum is adequate).

      In Sun's case would be interesting to see what happens if one of the zones triggers a kernel panic...

    7. Re:Hmmm.... by GiMP · · Score: 2, Informative

      User Mode Linux provides a hostfs driver for accessing the host's filesystem.

      You're right about not being as easy to setup, I suspect that Solaris has made it very easy to do - but this is speculation at this point.

      Linux has such resource allocations. Checkout /etc/security/limits.conf. This is a per-user setting, unfortunately.

    8. Re:Hmmm.... by sigxcpu · · Score: 2, Informative

      The UNL patch is in the -AC kernel and thus comes with RedHat, Mandrake and probably others as well.
      Just install the kernel-uml rpm which is included with the standard installation media.

      --
      As of Postgres v6.2, time travel is no longer supported.
    9. Re:Hmmm.... by Mikkeles · · Score: 2, Informative


      Or one can go (e.g.) to the original from IBM (first introduced in 1967).

      --
      Great minds think alike; fools seldom differ.
    10. Re:Hmmm.... by CoolGopher · · Score: 0, Flamebait

      If you run Solaris on x86 in a production environment you're an idiot.

      If you want Solaris, stick to Sparc. If you want NT/2k, then go for x86. Whether or not you might be an idiot for wanting NT/2k in the first place I'll leave for others to "discuss".

    11. Re:Hmmm.... by raider_red · · Score: 3, Informative

      It actually sounds just like a feature that Sun already has on their servers. The Sunfires and Enterprise models can be split into multiple domains, each of which is configured to look like a different machine on the network.

      --
      It's good to use your head, but not as a battering ram.
    12. Re:Hmmm.... by sapbasisnerd · · Score: 5, Informative
      Not the same thing. In point of fact Sun has had roughly equivilant hard partitions through domains for years as well, before HP.

      This is quite similar to vPar's in HP/UX (forgive me but I stopped paying attention to HP's ugly stepchildren Alpha & Tru64 a long time ago, it's too bad 'cause it was a great chip but its moribund, you would be wise to do the same pretty soon).

      Hard partitions, like Sun Domains, HP's nPARs and IBM's LPARs slice up a physical machine and run an OS image on each slice. As far as I can tell here there is still just one OS image but applications running in these Zones can be isolated from each other. A malicous root user in the global zone is still able to make mischief in the zones if they want to.

      The nice thing here unlike on HP is that you can slice up a uniprocessor machine if you have many tiny workloads that need to be isolated. IBM will too be able to do this soon with the next crank of their LPAR technology but a better implmentation with no issues with a global root user.

    13. Re:Hmmm.... by haggar · · Score: 1

      The FIRST LINE of my post is a disclaimer that clearly states where I quoted from.

      As for Karma, I don't know and don't care about it. It makes no difference to me.

      --
      Sigged!
    14. Re:Hmmm.... by christophersaul · · Score: 2, Informative

      The Zones mentioned here are sun's software partitions. Dynamic system domains are Sun's hardware equivalent of what you're talking about. You can adjust them on the fly, no reboot required, which I believe you can't do with Tru64. You certainly can't with HPUX.

    15. Re:Hmmm.... by shokk · · Score: 2, Insightful

      If the vendors are not selling any Alpha software for what you need to run your business, buy Alpha over Sparc would make you an idiot. You buy whatever fits your business, not for some overzealous philosophy or the l33test stats. For those who are running Sparc, this is one less thing that Tru64 has over Sparc. Yes, I have a beef with Sun over how they have pretty much sat on their laurels for the past couple of years while being passed by Intel, AMD, and anyone else scribing on silicon. While Intel and friends are talking about 4Hz and 5GHz systems, Sun is getting excited about their 3GHz stuff. Woohoo, big friggin deal. Frankly at this point I move as much stuff over to Linux on Intel as I can. The EDA vendors that have Sparc software are releasing their stuff for Linux and Hz vs Hz it is many times faster than Sun's products. Sun cannot compete in the small server market unless they pull a 4GHz system out of their wazoo.

      Of course, since clustering systems and grid computing are becoming more commonplace, the large server market may just not be as unapproachable as it once was either.

      --
      "Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
    16. Re:Hmmm.... by Anonymous Coward · · Score: 2, Insightful

      Welcome to the 21st century, where Sun Micro sells their own x86 and x86-64 servers, and Solaris x86 isn't just a portability demonstration.

    17. Re:Hmmm.... by todhsals · · Score: 1

      Tru64 and Alpha, well there's two products with a bright future ahead of them. Can you say end-of-life? Trust us you'll love HP-UX on Integrity.

      http://h30097.www3.hp.com/transition/
      http://www.hp.com/products1/evolution/alpha_retain trust/index.html

  2. Can this be used for honeypots? by El+Volio · · Score: 5, Interesting

    It would be cool to do something like the UML honeypots in Linux. You could run multiple systems, each insulated from each other and the host system, see what you get.

    --

    "You can never have too many elephants on your team."

    1. Re:Can this be used for honeypots? by Anonymous Coward · · Score: 5, Insightful

      If I am understanding the technology correctly, then I don't think you would want to run a honeypot/net in this configuration. The processes are isolated, but the kernel/core components are not.

      Most compromises break/modify some kernel/core components to achieve the compromise. If a honeypot/net were run using this configuration then, it seems, that once the honeypot/net were compromised, then the WHOLE system (read: the part you wanted to keep safe) would be compromised.

      Technology, like VMWare, uses a completely virtualized OS from a seperate installation and running instance of its kernel/core files. A compromise on a VMWare honeypot is much easier to recover from using the Snapshot/Revert features.

      Then again, I may not completely understand the technology.

    2. Re:Can this be used for honeypots? by Rik+van+Riel · · Score: 5, Informative

      The corresponding technology in Linux is called "vservers". It has been around for a number of years now, as an external kernel patch.

      You can find more info about it on linux-vserver.org.

    3. Re:Can this be used for honeypots? by Dillusionary · · Score: 4, Informative

      This is based on Trusted solaris as the underlining of the virtual system, but it doesn't share kernel/core as far as the SUN engineer explained it. So in the future you can have different versions of Solaris that support this technology running on the same machine. Everything is separated, FS,Kernel,Core,etc.. AFAIK :)

    4. Re:Can this be used for honeypots? by molnarcs · · Score: 5, Informative
      It is more like FreeBSD jails I think (but then, I may not completely understand these technologies as well :))

      Almost everything written under "Features:" can be also said about jails: Security, Isolation, Virtualization, Granularity, Transparency. For instance, you can put one single binary in a jail (if it works) or you can put there an entire system. Or, if you want to run a service in a jail (isolation, security), you can build the entire system with make buildworld targetting a jail,and you can optimize that system for running a single service, by stripping out most parts in make.conf:
      NO_SENDMAIL=true
      NO_SENDMAIL=true
      NO_OPENSSH=tru e
      NO_OPENSSL=true
      NO_KERBEROS=true
      WITH_LIBMAP= yes
      NO_VINUM=true
      NO_WHATEVER=true
      # and leave bind there if you want to run only DNS in jail
      Jailed processes/systems are so isolated, that even if you root one jailed system, you won't have access to the others/host system (unless admin was stupid enough to have the same passwords). Jails have their own ip addresses and firewall rules as well. I guess (if I read this correctly) we can say there is nothing new under the Sun :))
    5. Re:Can this be used for honeypots? by molnarcs · · Score: 2, Interesting

      Ooops, made a mistake: WITH_LIBMAP shouldn't be there (I copied my own make.conf, and forget to remove that line). That's for choosing between different threading libraries for your applications. (FreeBSD has three: libc_r - old one, libthr - 1:1 threading like linux, libkse - M:N threading).

    6. Re:Can this be used for honeypots? by Brandon+Hume · · Score: 4, Informative

      This feature has been compared to BSD jails, and it's logical to say that it grew from that feature, but the functionality isn't exactly the same.

      A Solaris zone can be rebooted independant of the other zones on the machine; it can have resources added or removed from the zone (CPUs, for example) dynamically, etc.

      I'm still installing my copy of SolExp, so I haven't played with the feature just yet. But it looks to be located somewhere between FreeBSD jails and a completely emulated machine like VMWare.

      --
      Brandon Hume
      hume -> BOFH.Halifax.NS.Ca, http://WWW.BOFH.Halifax.NS.Ca/
    7. Re:Can this be used for honeypots? by Darren.Moffat · · Score: 3, Informative

      Sorry but that is wrong. Both in Trusted Solaris and in Zones there is a single Solaris kernel that is responsbile for the isolation. This is separate userlands with their own nameservice their own filesystems and their own root account.

      Zones can't load kernel modules (except indirectly as protocol modules (eg telmod, rlmod), Zones can't (by default) access any raw devices and can't add new network interfaces by themselves.

    8. Re:Can this be used for honeypots? by Dillusionary · · Score: 2, Informative

      Then I was wrong, it wasn't explained like that to me by the SUN engineer, he said that the underline of the isolation is one kernel, but it doesn't sure kernels. He also mention that the underlining kernel is based on trusted solaris. Also pointed out that in later releases of Solaris, you will have the ability to upgrade one zone separately, away from all others. But you are correct the underlining kernel is the controller of the hardware, like HAL in Windoze.

    9. Re:Can this be used for honeypots? by robathome · · Score: 1

      I think Dillusional is really thinking about Solaris domains. On the old E10000 and newer SunFire servers, one can partition the box into completely independent systems. Each "domain" has a set of hardware resources (CPU, Memory, boot devices, etc.) allocated to it via the DR facility. Each has its own boot image and runs its own kernel. You can run multiple environments or even different versions of Solaris on the same box, provided that they support DR and domaining.

      Under the hood, however, this is nothing like the zoning feature being described by the OP.

      --

      At 3 A.M. you can see people's auras; at five you can see their contrails...
    10. Re:Can this be used for honeypots? by Anonymous Coward · · Score: 0

      Sorry to say this... But it's not part of linux (which is ONLY the kernel if any of you can remember that) if it's a 3rd party patch and not supplied by the same group which develops the kernel.

    11. Re:Can this be used for honeypots? by Spoing · · Score: 1
      1. Sorry to say this... But it's not part of linux (which is ONLY the kernel if any of you can remember that) if it's a 3rd party patch and not supplied by the same group which develops the kernel.

      *BLINK* Oranges are orange and Apache doesn't give me a pre-made web site...how is this a problem with the Linux kernel and vservers?

      --
      A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
    12. Re:Can this be used for honeypots? by viktor · · Score: 1

      Sun has gone to great lengths to make sure that a compromized zone does not imply compromize of other zones.

      In fact, one of Suns examples is a Zone for each service, where the technician that explained to me explicitly said that if one of the Zones run a sendmail which is rooted, the others are unaffected because there are separate "root" accounts for each zone (and we're not just talking separare passwords but actual separate root:s).

      They protect stuff like /dev/kmem, you can't access raw devices, and so on within Zones. The machine still has a "core", outside of any Zones, which is a regular Solaris environment, but from within a Zone it's apparently very, very difficult to break out. Sun calls it "impossible" which means you'll most likely need to find a bug within the Zone implementation itself to break free.

      Sun's also done similar things within Trusted Solaris before, so it's not something they just came up with.

  3. Look up Argante by SharpFang · · Score: 4, Interesting

    That was a project of a cross-platform "virtual OS" to be run "on top of" other OSes (loaded like a normal process) designed with security in mind - building exploits in it was meant to be impossible. I'm not sure about progress, but launching 10 Argante processes on, say, plain Linux running nothing but "bare bones" was meant to be equal to creating 10 computers, each running Argante OS, to create, say, 10 super-secure servers.

    --
    45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
    1. Re:Look up Argante by afidel · · Score: 2, Insightful

      User mode Linux is similar. It's nearly impossible to break out from the child servers to the main server. I know of several hosting services that use this to give clients "private" servers at a reduced cost.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    2. Re:Look up Argante by MrBlue+VT · · Score: 1

      Yep, I got a very nice virtual server from Tektonic for $15 a month. Very nice because you can then resell that to people for designing and hosting webpages, email, etc. Best part is having root, so you can admin the machine yourself. If you don't need a full server, this makes a lot of sense.

  4. Question by mikeophile · · Score: 2, Interesting

    Is this similar to running multiple instances of VMWare or Bochs?

    1. Re:Question by Anonymous Coward · · Score: 1, Informative

      It seems to be similar to running VMware with multiple virtual machines (VMs) where each VM runs the same OS with different apps.

    2. Re:Question by mmusson · · Score: 3, Informative

      This sounds like a small part of vmware. With vmware you can install multiple different OSes and run them concurrently. Also you have the ability to pause a vm (save the running vm state to disk) and also snapshot/restore. This later feature is great if you are testing. Being able to back up to a known machine state at a press of a button is very handy.

      --
      SYS 49152
    3. Re:Question by addaon · · Score: 2, Informative

      It seems a lot closer to VMWare ESX than VMWare workstation, from the quick blurb.

      --

      I've had this sig for three days.
    4. Re:Question by Sabalon · · Score: 1

      Sorta kinda. It sounds more like a chroot jail, just a little larger. Some calls are intercepted and zonified - so one process will think the machines IP is 10.0.0.1 and another will think it's 10.0.0.2 because they are in different zones, where the machines actuall IP may be 10.20.10.1.

      With VMWare/Bochs, you are running multiple copies of the OS...one for each virtual machine, running under one master OS. With this zone method, it's basically the OS lying to it's programs about various things!

  5. Only if it works... by RunAmuk · · Score: 5, Interesting

    This would be interesting to see if the installer actually worked. I tried downloading and installing the Solaris Express preview on my SunBlade 100, and the installer died halfway through the installation. When I was finally able to get the installatin finished, I couldn't even make it recognize the integrated network card.

    I've always been surprised how Linux installers can easily support the large variety of OEM Network cards available, and yet Sun can't make an installer that recognises their own hardware.

    1. Re:Only if it works... by Anonymous Coward · · Score: 0

      the best are the smartcard drives in the sunblade 1000s that weren't supported by their OS when they originally shipped the hardware

    2. Re:Only if it works... by Build6 · · Score: 1

      is there any chance you ended up with a corrupted installer? (md5sums match?)

  6. Just like Xen, in other words? by vinsci · · Score: 3, Informative

    This sounds like Xen for Linux...

    --

    Trusted Computing FAQ | Free Dawit Isaak!
  7. Re:UML honeypot? what does Fowler's book have here by oglueck · · Score: 5, Informative

    UML here means User Mode Linux.
    You are refering to UML as Unified Modelling Language

  8. don't forget... by qortra · · Score: 4, Informative

    Don't forget Xen, VMWare, and Bochs (not as fast, but still cool).

    There are already a ton of viable OS virtualizers out there. This news is seriously a real yawner.

    1. Re:don't forget... by iserlohn · · Score: 5, Informative

      and also Linux-vserver. Great performance. Just like BSD jail.

      --
      :. Ultimate Control Dedicated/VM Servers
    2. Re:don't forget... by meshko · · Score: 1

      I think this has nothing to do with OS emulators.
      It's more like FreeBSD jail.

      --
      I passed the Turing test.
    3. Re:don't forget... by chilled · · Score: 2, Informative

      Actually it's not really like vmware et al. Part of the reason for zones is to make life as an admin EASIER not harder. Say a sys admin has a single Solaris machine (SPARC or x86, it doesn't matter). They are running 10 zones, however the sys admin only has to maintain one OS. There are additional overheads, ie setting up resource controls, but they are there and relatively simple, building up on pre-existing but extended Solaris 9 concepts (Solaris Resource Manager), but much easier than maintaining 10 different servers. I might be wrong, but you would need 10 different OS installs, on top of the original vmware hosting server.

      --
      Brought to you via Pidgeon TCP
    4. Re:don't forget... by wukie · · Score: 1

      This news is seriously a real yawner Obviously you don't manage any Sun servers, but if you did ...

  9. Jails vs. Zones by Vexler · · Score: 2, Informative

    From what I read in the newsgroup article, this sounds awfully like the "jail" feature in BSD. You can effectively set up entirely different machines using jails. You can reboot, configure, and manage individual jails just like zones.

    Can anyone more knowledgeable comment on whether they use similar kinds of calls to set up a zone as opposed to a jail?

    1. Re:Jails vs. Zones by sysadmn · · Score: 4, Informative

      Zones differ from jails in that you can limit the amount of resources a zone can consume. Even in jail you can launch a denial of service with a fork() bomb or busy loop, or even netcat. With zones, you can limit the amount of cpu cycles, network io, and (perhaps? don't have docs nearby) disk and serial io. Plus zones get their "own" virtual os, so you can reboot them.

      --
      Envy my 5 digit Slashdot User ID!
    2. Re:Jails vs. Zones by mr_majestyk · · Score: 2

      Plus zones get their "own" virtual os, so you can reboot them.

      Sure about that? All the zones share the same copy of Solaris, so how can you reboot one without rebooting all the others?

    3. Re:Jails vs. Zones by chilled · · Score: 5, Informative

      Very sure.
      The zones routines, just re-read the zone config and re-initialise it. From the outside it can appear as an OS, but from another perspective (and this is gross over simplification but works for this point) it's just like loading an instance of an application.

      --
      Brought to you via Pidgeon TCP
    4. Re:Jails vs. Zones by paxvel · · Score: 2, Informative
      Marko Zec has done an excellent work on further virtualizing FreeBSD kernel: Network stack cloning / virtualization extensions.
      Within a patched kernel, every process, socket and network interface belongs to a unique virtual image. Each virtual image provides entirely independent:

      * set of network interfaces and userland processes;
      * interface addresses and routing tables;
      * TCP, UDP, raw protocol control blocks (PCBs);
      * network traffic counters / statistics;
      * set of net.inet tunable sysctl variables (well, most of them actually);
      * ipfw and dummynet instance;
      * kernel message buffer instance;
      * system load and CPU usage accounting;
      * proportional share CPU scheduling
    5. Re:Jails vs. Zones by KingOfBLASH · · Score: 1
      Zones differ from jails in that you can limit the amount of resources a zone can consume. Even in jail you can launch a denial of service with a fork() bomb or busy loop, or even netcat. With zones, you can limit the amount of cpu cycles, network io, and (perhaps? don't have docs nearby) disk and serial io. Plus zones get their "own" virtual os, so you can reboot them.
      To add to the protection of chroot / "jails", the BSDs have the limit command to allow you to cap how much CPU and memory a process is allowed to consume. Linux has something similar*, if I remember correctly. Run vulnerable processes at a slightly lower priority then the rest of your system (make sure you're not soaking up your resources or lower the priority of everything else that is if you want to have your process actually do things from time to time) and you've got plenty of ways to do what this is doing, although I suppose it wouldn't be nearly as easy to set up or as elegant.

      * IIRC, it involved a kernel patch.
    6. Re:Jails vs. Zones by Anonymous Coward · · Score: 0

      (u)limit comes with your shell so can be done cross platform. BSD's also have login classes which allow you to specify various limits including the users default nice level. Solaris also has kernel options like maxuprc, noexec_user_stack, rlim_fd_cur. I'm not as familiar with linux.

      Zones also lets an administrator reserve cpu 0 and 1 for zones 1-100, cpu2-7 for zones 101 and 102, and only 30% of cpus 0 and 1 for zones 103-110, plus further restrictions on who gets to see what nics, drives, memory, etc. At least, that's my understanding based on the sessions i've attended.

    7. Re:Jails vs. Zones by arturs · · Score: 1

      in a vserver, you can control resources for a given vserver (in different ways). You can experiment with a fork bom inside a vserver, quite a good experience.

    8. Re:Jails vs. Zones by dohcvtec · · Score: 2, Informative

      Here is a very informative article not only describing Solaris Zones, but also showing it in action. From what I can see, it seems similar to UserMode Linux, but nicely integrated into the OS, and supplied with a good set of administration tools.

      --
      -- Never hit a man with glasses. Hit him with a baseball bat.
  10. But... does "rebooting" a zone fix issues? by 192939495969798999 · · Score: 5, Interesting

    What makes zones so important in large systems is the ability to restart one, or totally reconfigure it, without taking down the other zones. This seems obvious, but it helps put a layer in between the hardware and the software. What surprises me is that if so many other platforms already supported this to a large degree, how come its deployment has not been extensive? It seems like a great feature.

    --
    stuff |
    1. Re:But... does "rebooting" a zone fix issues? by gilrain · · Score: 3, Informative

      It has been! Notice the huge growth of "virtual colocation" services? Those are usually run with BSD jails or UML. They are a middle ground between consumer shared hosting and full-on managed servers.

      This technology has already created a successful and useful market. I think we can only expect more.

    2. Re:But... does "rebooting" a zone fix issues? by nemaispuke · · Score: 5, Interesting

      Yes there are other platforms that have similar features (AIX LPAR and DLPAR, HP-UX VPAR, Solaris Dynamic Domains). The problems are (1) you have to be using recent versions of the OS for the software virtualization (AIX 5L 5.2, HP-UX 11 and 11i) or (2) have the specific hardware necessary to use the hardware virtualization (AIX, HP-UX, and Solaris). And this hardware is costly (minimum cost for a Sun Sun Fire midrange to support dynamic domains is $100,000.00).

      The other reason could be that management (particularly in DoD) won't allow the use of hardware or software virtualization despite the benefits. Management could see this as a "toy" rather than a feature. Of all the documentation I have read concerning DoD, implementation, security, etc., I have never read anything about setting up or using virtualization. Not to say that some DoD activities aren't using it, but they are not well "advertised". The last Navy project I worked on we tried to deploy an Open Source monitoring solution and was basically told "we will not the first in doing anything!"

    3. Re:But... does "rebooting" a zone fix issues? by Spoing · · Score: 1, Funny
      1. What makes zones so important in large systems is the ability to restart one, or totally reconfigure it, without taking down the other zones.

      This "rebooting" that you speak of...tell me more...it is forign to me.

      --
      A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
    4. Re:But... does "rebooting" a zone fix issues? by spell · · Score: 2, Informative

      AIX does have DLPAR, but the problem with this is that it is only partitioning on a CPU boundary which means despite the fact it is supported on lower-end AIX boxes kind of limits it's use. However with AIX 5.3 and Power-5, DLPARing will be at a sub-CPU partition, up to 100 partitions per CPU is what I've heard. The Power-5 machines will ship with the lower end first before the replacement to the p690, certainly less than $100k per box. It will also support virtual networking etc, so that the LPARs will not have to go out onto the network and the traffic will stay within the box (much goodness). So although Zones sound good, I think that genuine virtual machines ala LPAR are better.

    5. Re:But... does "rebooting" a zone fix issues? by TKinias · · Score: 1

      scripsit Spoing:

      This "rebooting" that you speak of...tell me more...it is forign to me.

      Hmm... What kernel version is that? And what's your IP?

      --
      In principio creauit Linus Linucem.
    6. Re:But... does "rebooting" a zone fix issues? by tchuladdiass · · Score: 1

      Gee, just the other day on a fresh linux install (redhat 9), I had an instance of rpm hang up. Couldn't kill it, even with kill -9. Couldn't run any other instances of rpm either. strace showed that it was hung up in a futex() system call. man futex didn't show anything, I didn't have time to debug it, so had to reboot it.

  11. in comparison? by beware1000 · · Score: 0, Redundant

    what kind of advantage does this have over say... a chroot jail? or are processes in different zones jailed off from one another?

    1. Re:in comparison? by peterpi · · Score: 2, Insightful
      Quite possibly nothing technically, but when a company with the sort of customers Sun has says it will support something, they have to be damn sure it'll work.

      If your LinBSD chroot experiment screws up, you can get told to RTFM by the resident "expert" on your favourite mailing list. If your Sun box goes tits up, Mr. Sun engineer comes round and fixes it for you before you've finished typing the mail.

      I'm not saying one method is better than the other for all people, but when you're betting a zillion pounds an hour on it working, it's nice to have backup :)

    2. Re:in comparison? by smitty45 · · Score: 3, Informative

      "fixes it for you before you've finished typing the mail."

      no need to exaggerate here.

      the differences between jails and zones should be quite clear, but I can see how someone not having a Sun engineer on the clock to explain it to them might not get it.

      zones should be used for a completely different purpose than jails. chrooted 'jails' are for restricting the runtime and filesystems environments for a particular process. in most cases, chrooted jails have nothing but the bare minimum libs and binaries, but it spawned from the original kernel which the parent machines runs.

      zones are more like vmware in the way that it is a self-contained runtime environment that has its own protected memory space and kernel...these can then be restricted and allowed for full destruction, since the parent OS is not ifluenced in the same way as a chrooted jail.

      in my opinion, Sun's support has never been worse or better than SGI's, HP's or DEC's...and that is still true today. the guy asked a question about the differences between jails and zones, not which is better from a support standpoint. it's a digression, and somewhat of a trolling one at that.

    3. Re:in comparison? by peterpi · · Score: 1
      the guy asked a question about the differences between jails and zones

      Yes, that's true. I guess I was being too cynical!

  12. The neatest benefit by ArmenTanzarian · · Score: 4, Funny

    Network security will now be called "Zone Defense."
    What does that make man-to-man? P2P?

    1. Re:The neatest benefit by Anonymous Coward · · Score: 0
      Network security will now be called "Zone Defense."

      And Apple will come out with their own security product called the iFormation.

  13. So... by thrill12 · · Score: 0, Interesting

    ...it's just VMWare ESX Server for Solaris then ?

    It's probably an interesting tool for hosting companies that wish to sell Solaris ('root')-servers...

    --
    Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
    1. Re:So... by fr0dicus · · Score: 1

      It's an interesting tool for any company looking at easy consolidation without the prohibitive costs of hardware partitioning.

  14. Not Quite ! by Anonymous Coward · · Score: 5, Informative

    >Where have I seen this before... Oh that's right,
    >the features Compaq/Hp have been shipping with
    > their Tru64 Alpha Servers for _years_.

    First I watched this movie, your comparsion is unfair; HP/Compaq/DEC partitions are more like Sun domains, i.e implemented in hardware. Domains have been around since say 1996 when E10K was introduced.

    > Sorry people, but sun are pushing 20th century
    > technology with some marketing spin to make it
    > sound up to date.

    While Solaris zones are similar to UML or other virtual OS instance technologies there are some innovative features which would be really useful say on multiprocessor Opteron that you want to consolidate some applications on:

    1) Support: I can expect to run Oracle/websphere,
    etc in this zone without having to say oh and this is UML (which I have seen many times on mailling lists) (I mean applications support the fact that a OS vendor is behind this is good news as well)

    2) Integration with Global Zone. From the global zone you can control each zone and watch and cap resources within a zone. This means modications to ps/prstat(solaris's top) and other core OS utilities. How hard would this be under Linux? Is the UML patch even accepted by Linus yet?

    3) Inteface bindings - can bind zone to specific NIC.

    4) Greenline - init.d replacement becomes service aware and can stop/start zones at boot and monitor services within a zone.

    5) Dtrace - the greatest thing even, dynamic tracing of the kernel. Fully integrated with Solaris Zones.

    1. Re:Not Quite ! by arturs · · Score: 2, Informative

      At least some of those are really working well in a vserver:

      > 2) Integration with Global Zone. From the global
      > zone you can control each zone and watch and
      > cap resources within a zone. This means
      > modications to ps/prstat(solaris's top) and
      > other core OS utilities. How hard would this be
      > under Linux? Is the UML patch even accepted by
      > Linus yet?

      Very similar. You also get vps, vpstree, vtop, vkill, vdu utilities for management starting from security context 0 (hosting server, which uses context 1 to "see" all processes).

      > 3) Inteface bindings - can bind zone to specific > NIC.

      very well working in vserver

      > 4) Greenline - init.d replacement becomes
      > service aware and can stop/start zones at boot
      > and monitor services within a zone.

      vserver also has a reboot manager; as for service monitoring, you can use userland aplications for any vserer or set them in a host server to switch to security context 1 and thus monitor all services globally.

    2. Re:Not Quite ! by Anonymous Coward · · Score: 0

      umm..mainframes anyone? IBM's hmc has been doing zoning for years. aix systems now do the same thing, and use what? an hmc!
      and those p690's can run linux too...actually ship with redhat.

    3. Re:Not Quite ! by julesh · · Score: 1

      Is the UML patch even accepted by Linus yet?

      Yes. It's an official 2.6 feature.

  15. Solaris Express by njcoder · · Score: 5, Informative
    "available in solaris express (the pre-release of Solaris 10). "

    Solaris Express is a program that they are using to give people early access to sun software. Solaris 10 is not solaris express

    --
    Open Source Java DAO Generator
    1. Re:Solaris Express by cubic6 · · Score: 1

      Interesting. That's not what Sun says, and I'm more inclined to believe them over you.

      Software Express for Solaris home page

      The general program is Software Express, which is what you described. The specific program which gives access to a preview of Solaris 10 is called Solaris Express. So the article is using the right term.

      --
      Karma: Contrapositive
    2. Re:Solaris Express by njcoder · · Score: 1
      You're right that Software Express is the program that gives early access to new Sun Software. Solaris Express is the program that gives early access to the new versions of solaris "The Solaris Express program can help anyone needing access to the latest innovations from Sun, "

      Still... "available in solaris express (the pre-release of Solaris 10). " implies that solaris express is the pre-release of Solaris 10, which it isn't. Solaris Express is the program by which you can get Solaris 10.

      Every where I read about Solaris 10, they call it Solaris Express, except on Sun's site. I don't know if there's confusion because someone refered to Solaris 10 as Solaris X (roman numeral)

      --
      Open Source Java DAO Generator
  16. linux-vserver/BSD jail by iserlohn · · Score: 5, Informative

    Essentially the same as what the linux-vserver project http://www.linux-vserver.org/ or BSD jail feature provided. It sets up different contexts for different processes so that they are isolated from each other with a different root directory. The effect is that they acts each context acts like a separate sever, but in fact they are all running on the same kernel.

    Linux-vserver is a great project. We have been running different services under differnt "virtual" servers for a while and its performance is stellar.

    --
    :. Ultimate Control Dedicated/VM Servers
  17. FUD by Anonymous Coward · · Score: 2, Informative

    This is not true; I have run several copies of Solaris Express (b42, b44, b51) on several Sun Blade 100/ Sun Blade 150s. Install was fine. There are some bugs; yes. Which is why this is a beta. But basic support for networking and install are not one of these bugs. Nice try.

    1. Re:FUD by RunAmuk · · Score: 2, Insightful

      This isn't true? Sorry, I didn't see you sitting there next to me while I ran the install. I wish you had told me that the blank screen the install froze on (I left it for an hour before restarting) was part of a "fine" install. This happened all THREE times I tried to run the installatn. I also wish you would have told me that network card wasn't supposed to let me see anything on the network, before I spent 2 days on and off trying to get it to. Had I recognized these components of a fine intstall I probably wouldn't have made this post.

      When I reverted back to Solaris 8, I had no blank screen during the install, and while the network card wan't recognized and configured properly there, I had no problem setting it up after the install. I guess my point is, just because you didn't encounter bugs, it doesn't mean they don't exist.

      I realize this is a beta release (I don't remember exactly which one, but I downloaded it about three weeks ago), but the installer has been around for a while, shouldn't it be able to recognize Sun hardware?

    2. Re:FUD by Anonymous Coward · · Score: 0

      First, there is not network card on a Blade 100 unless you have added one, have you?

      Second, have you discussed that on the comp.unix.solaris ? if why not!

      It sounds not likely that a Solaris Express released build would not work on a Blade 100, but ofcourse it could be true, but then you should get help via comp.unix.solaris, it's a great usenet group.

    3. Re:FUD by christophersaul · · Score: 3, Informative

      My colleagues had no problems on an x86 laptop or Ultra 10. Don't bother with the installer, just boot off CD1, if it's anything like Solaris 9/9. The installer is just a pretty front end that ends up adding ages onto the install.

    4. Re:FUD by RunAmuk · · Score: 1

      Actually, the SunBlade 100 did come with an integrated network card, see http://sunsolve.sun.com/handbook_pub/Systems/SunBl ade100/spec.html

      When I encountered the problem, I started by looking around at SunSolve, and never really thought of going to straight to comp.unix.solaris from there. I was interrupted in my fiddling with the system by the arrival of my first child, so I reverted Solaris 8 knowing it would work. You raise a good point though, now that I have a bit more time, I should go there and see what the discussions there have to say.

    5. Re:FUD by Anonymous Coward · · Score: 0

      Ever consider that you're a dumbass and don't know what you're doing?

    6. Re:FUD by Mr.+Piddle · · Score: 1


      Yeah, I don't even know why Sun ships that "Install CD", when the real install program is in CD1. The Install CD must be for the occasional sysadmin who needs a bib to protect his shirt from drool.

      --
      Vote in November. You won't regret it.
  18. Oh yeah? by Anonymous Coward · · Score: 0

    Well if this is SO common in other flavors of UNIX, then why hasn't Linux copied it yet, hmmm?

    If it were that ubiquitous, Linux would have knocked it off already and claimed that it's some major step forward.

  19. looking at the bootup of his system.... by Anonymous Coward · · Score: 1, Interesting

    What sysadmin with any brains runs NIS in this day and age? Thats so 1995. I mean come on, you might as well post your passwords on the wall for all to see.

    NIS+ or LDAP, folks....

  20. bah by tuffy · · Score: 4, Funny
    It's clearly just a shameless ploy to gain market share.

    :)

    --

    Ita erat quando hic adveni.

    1. Re:bah by MissP · · Score: 1

      a shameless ploy to gain market share? That's what companies are supposed to do! Give the customer what they want and need. What is "shameless" about that?

    2. Re:bah by smitty45 · · Score: 1

      which is different from other for-profit companies ?
      It should be shameless.

    3. Re:bah by Anonymous Coward · · Score: 0

      Well, for one thing, your sense of humour is definitely shameless.

  21. Greetings, retard. by Anonymous Coward · · Score: 0

    What part of 'beta' do you not understand?

  22. Sun says this isn't like a VM thing by dukerobillard · · Score: 5, Informative
    I've been prowling around Sun's site on this, and apparently it isn't like the old IBM 360 VM thing (or VMWare, or any of the many other Virtual Machine stuff people have mentioned). Zones aren't a VM that you run different kernels in, they're "application containers" running under a given kernel.

    It sounds to me more like a Java Servlet container model than a VM. There's even a "global zone" that can see all the others.

    Here's a post about it.

    Here's Sun's page on it

    1. Re:Sun says this isn't like a VM thing by McLoud · · Score: 1

      In fact, didn't RTFA, but it looks like the Linux Virtualization, wich aims to run an linux inside itself, but with no VM

      --
      sign(c14n(envelop(this)), x509)
  23. Jacques Gelinas' VServer by Gollum · · Score: 5, Informative

    This looks just like the Virtual Server project that Jacques Gelinas started a number of years ago. Possibly with some neat configuration utilities, but much the same. I'm not sure whether VServers can be allocated a dedicated CPU, or certain hardware exclusively, etc, but I think it can.

    Xen, on the other hand is a much "heavier" approach, similar to VMWare, which virtualises the hardware, and emulates certain peripherals.

  24. Re:UML honeypot? what does Fowler's book have here by Ubergrendle · · Score: 1

    Mod parent up!

    Thanks for the clarification. As an basic unix user I was having a hard time following these threads until I realised UML was not what I was thinking it was!

    --
    John Maynard Keynes: "When the facts change, I change my mind. What do you do?"
  25. Re:UML honeypot? what does Fowler's book have here by raider_red · · Score: 3, Funny

    I guess the smartass answer is to say that Unified Modeling Language is a honeypot for trapping managers.

    --
    It's good to use your head, but not as a battering ram.
  26. BSD Jails by maitas · · Score: 1, Informative

    Actually this is Sun's implementation of BSD jails with their "Resource Manager" software for resoruce allocation.

  27. Nice addition to the existing domain capabilities by adam872 · · Score: 4, Informative

    Sun has had the ability to do multiple system images on the same box for a while, but they've always been hardware partitioning only. The 4800/6800/12k/15k allowed you to run different domains on the same system, so long as you had the right combo of CPU and I/O boards. This was great if you had one of those systems, but not so hot it you had a workgroup level system (e.g. E450 or V880). I'm glad to see they've put software partitioning in the O/S so I can take a mid range system and chop it up into separate pieces. AIX and HP-UX have been able to do the software side thing for a while (but not the dedicated hardware piece, I believe).

    This will help with consolidation and utilisation on existing machines, I think.

  28. Details by Anonymous Coward · · Score: 1, Redundant
    Disclaimer: I am not the author of the following post, I took it from here.

    I believe this is not too far from what you can achieve with user mode linux. We've been using similiar technology in unix classes at school using uml.

    There are however few differences:

    1.) Solaris accesses host filesystem, while in user mode linux, you have to provide file or block device with disk image it will use. This is quite bad, because you have to preallocate space for zones. There is a project that aims to allow this, but I don't know how usable is this. You could of course overcome this by doing Root FS on NFS and dhcp and letting the guest os mount host's partition via NFS. This would probably have quite significant performance overhead though :(. Filesystem in filesystem is not very optimal too.

    2.) It is not that easy to setup. This could be done with few scripts. I would love Debian and possibly other distros to have scripts, which would instantly create the zone's filesystem. Preferably, it would allow for some sharing (f.e. creating hard links to original data and kernel would unlink, copy transparently if slave wants to write -- some equivalent of copy on write seen in memory management).

    3.) The networking is not so easy to setup. Could be also part of the script

    4.) Linux does not have so well done resource allocation as Solaris. So the guest kernel should be able to limit itself (f.e. not to use more than 30% of cpu time). Is it possible to do some precise resource allocation under Linux (maybe using some patch to kernel, or something like that?)

    1. Re:Details by sciuro · · Score: 1

      the rootstrap package, available for debian, does exactly this. a configuration file allows a UML instance to download and install packages (using apt) creating a debian root image for use with UML.

      -duncan

  29. Linux equivalent is User-mode by wukie · · Score: 1

    http://user-mode-linux.sourceforge.net/

  30. How's this different from running wmware? by joda · · Score: 0, Redundant

    ... or bochs for that case.

    Seems to me it's just a fancy name for an already existing product.

    --
    Buy all your crazy japanese videogames from
    1. Re:How's this different from running wmware? by Anonymous Coward · · Score: 0

      The difference between Solaris zones and bochs or VMware is that Solaris zones don't emulate an entire virtual machine. They share one kernel and provide multiple instances of all the stuff on the user side of the user/kernel barrier. There is still one single memory manager (paging algorithm, etc.); it's just zone-aware. The process id number space is shared, but the zones you create can't see each others' processes. Basically, it's more tightly integrated. I don't have the scoop, but this should mean it is easier to get very good performance out of it. There is no reason why there should be anything more than a 0.01% performance penalty. Certainly not something you can say with bochs and really not something you can say for VMware either.

  31. Re:Partitions arent new... by wukie · · Score: 1

    So how is that relavent to existing Solaris users?

    The point is "It's available to Solaris users"!

    It doesn't matter whether VMWare, User-Mode Linux, SGI, HP, Digital or whoever came up with this. The point is it's available in SOLARIS NOW! (well soon)

  32. Re:Nice addition to the existing domain capabiliti by christophersaul · · Score: 2, Informative

    AIX and HPUX have been able to do similar-ish stuff for a while, but with severe restrictions. IBM's LPARs require a mix of hardware and software and IBM recommend a minimum of three cpus. There are other restrictions regarding sharing I/O boards, etc, etc. You can't dynamically resize an LPAR without a reboot, for example.

    With the mix of software 'zones' and Sun's hardware oriented dynamic system domains, you have something that's a lot more powerful than IBM's LPARs.

    HP can do what I believe they call VPARS, which are like Sun's system domains - carving a server up into separate hardware separated servers. They have no dynamic capability though - if you want to allocate more cpu and memory to your Oracle batch job overnight, you have to make the adjustments and reboot the server for the changes to take effect. A Sun box with domains will take care of the changes on the fly.

    I don't know if they can do a sofwtare only zone-type thing. I believe they can't.

  33. Questions by giminy · · Score: 1, Interesting

    Is a zone just a stripped-down virtual machine? This doesn't seem to be answered too well, but that's what it looks like.

    VMs are bad, if only because the I/O performance takes an obvious hit. Any attacker worth his/her salt would be able to tell that they're logged into a VM with a little experimentation...so this thing's use as an effective honeypot is pretty much (against a smart attacker).

    --
    The Right Reverend K. Reid Wightman,
  34. Re:Only if it works... What a Schmuck! by Anonymous Coward · · Score: 0

    I had NO problems doing just that on my Sunblade
    100. Must be a user error.

  35. Re:um, freebsd jails by wukie · · Score: 0, Offtopic

    Yes, FreeBSD forever, till the boss says, the budget is half a million for the next year, then it's "Good morning Sunshine!"

  36. Solaris Needs to Pay More Attention to Detail by SoupIsGood+Food · · Score: 0, Troll

    I've got a fairly standard Sun Ultra2 Creator3D workstation. Solaris 9 was a complete horror show... I've got many years experience noodling around with Solaris, from it's old SunOS 4 days as "Solaris 1" right up to Solaris 7 (2.7, for those on the inside.) I know what the hell I'm doing, but I was completely baffled and defeated by Solaris 9. Nothing worked, from the installer to the administration utilities (command line and GUI) to the SunScreen firewall software. I spent a week trying to get this basic web server/NAT firewall up and running. It's lack of attention to basic detail is inexcuseable, and goes a long way toward explainging why Sun has lost so much market share in the past two years. IBM's a PITA to work with, but it's well documented and works out of the box with only a bit of tinkering.

    For grins, I popped out the extra processor, and loaded, configured and deployed OpenBSD in all of three hours, NAT and Apache and DJBDNS and all.

    I tried an earlier build of Solaris 10, and it didn't go at all well. I'll try this one (which purportedly has a Sun-comissioned version of IPfilter), and if I can't get it to do what I want in an afternoon, I'll slap SuSe on it instead. Or Gentoo... Gentoo might be fun, even if does take forever to compile.

    SoupIsGood Food

    1. Re:Solaris Needs to Pay More Attention to Detail by wukie · · Score: 1

      I run FreeBSD on an x86 SMP box and prefer it to Linux (I have Debian on the box to play with 2.6 kernel), I'm certain FreeBSD supports multiple processors on Sparc hardware.

      Have you tried FreeBSD? Just curious.

    2. Re:Solaris Needs to Pay More Attention to Detail by christophersaul · · Score: 1

      Hmmm. Sun's Unix business is larger than HP and IBM's combined and grew recently after the dotcom horror fallout which affected pretty much everyone - so careful about bandying about claims of 'losing so much market share' :)

      As for your problems with the Ultra 2, I've never experienced anything like that and I've installed Solaris 8 and 9 on all sorts of kit over the last couple of years. SunScreen is a nightmare to administer though, I have to agree.

    3. Re:Solaris Needs to Pay More Attention to Detail by christophersaul · · Score: 2, Interesting

      Should have added that if you want to get all the OSS stuff installed easily on Solaris, you can easily download it from Sun.com, or better still use pkg-get, an apt-get style tool for Solaris. Do a search on Google for pkg-get and it'll pop up. It's excellent.

    4. Re:Solaris Needs to Pay More Attention to Detail by Anonymous Coward · · Score: 0

      you clearly DON'T know what you're doing.

      1: Solaris 9 will ALWAYS run badly on that crappy hardware.

      2: Solaris 7 was NEVER known as 2.7, EVER. It may have been known internally as SunOS 5.7 however.

      Shut Up, Wesley.

    5. Re:Solaris Needs to Pay More Attention to Detail by SoupIsGood+Food · · Score: 1

      Right out of the box, it screwed up the partition sizes using the defaults to where needed packages couldn't be installed. Hand-tweaking was a PITA because of the lack of clear documentation about how much space /var and /usr actually need. So I punked out and set it up all as one giant partition, which needs a fsck in single user mode to repair serious errors on every reboot. This was using both the graphical installer (stop laughing! How was I to know it still sucked two revs later?) and the text based installer on Disc One. Neither of which installed the device driver for the qfe card... nope, that required re-installing the whole damn thing as an update. Had to configure the ports by hand, because both the installer and sys-unconfig wouldn't see any of the ports, qfe or happymeal, once the driver was installed.

      I wanted to tinker with Gnome, but it wasn't configured to run with my video hardware, so it was dithered and had a nasty habit of crashing back to the login screen. CDE actually worked with the Creator3D card, but kept tanking, usually in the middle of something important. Admintool, useradd and the new web console thingamabob all failed to create a new user account, but vipw still worked, thank god.

      This is with a bone-stock Solaris 9 install. It's the most fundamentally broken version of Solaris I've ever installed. Even 2.3 and 2.5 before 2.5.5 with their various memory leaks and log overflows was a cakewalk compared to this.

      (I know about pkg-get. I was using Sun Freeware back when there was no pkg-get and the available packages insisted on installing everything in /opt, whippersnapper. Or was that the HP-UX freeware site? I forget. It's selection is still woefully small compared to any of the available packages for an OSS system, or even MacOS X's Fink.)

      SoupIsGood Food

  37. Zones aren't going to help by superpulpsicle · · Score: 0

    I am sorry but isn't this more or less the same as CPU partitioning like the Xeon hyperthreading.

    Sun needs to lower the prices of sparc systems so that a 400mhz sparc doesn't cost $1000 in the year 2004. If it wasn't for Ebay sun would have disappeared in more places than just datacenters.

    1. Re:Zones aren't going to help by Darren.Moffat · · Score: 2, Informative

      Nope it is nothing what so ever like that. It looks to the applications like a totally separate machine, with its own network interfaces, its own filesystems and its own CPUs.

      Unlike LPARS or Sun Fire Domains this does NOT require any additional hardware for a Zone. You could hosts hundreds of Zones on a single CPU machine with a single disk and single network interface, you are limited only by what they do.

  38. Zombie zones by Anonymous Coward · · Score: 0

    Who watches the zones? I see virant ridden mutant zones slipping around unssen within the system.

  39. So how long before open source rips this great by Anonymous Coward · · Score: 0

    idea and sticks it into Linux distros. Open source == useless leeches of the OS world...

  40. Is this like CHROOT in Linux? by PetoskeyGuy · · Score: 1

    I've read about chroot, and even set one up a while ago, but more or less just using the howto. Are Solaris Zones similar to the chroot setup in Linux?

    1. Re:Is this like CHROOT in Linux? by Darren.Moffat · · Score: 2, Informative

      Chroot is not secure, all it really does it change the location of what the application thinks is the root of the filesystem. root in a choot is the same root as the rest of the system. You can break out of chroot environments.

      Zones are full application environments with their own network addresses, their own filesystems, etc etc. They look to users and applications like separate machines, but their are acutally all running on a single Solaris kernel that ensures resource and security isolation between them. They can be independantly administered, (re)installed and rebooted.

  41. Re:Nice addition to the existing domain capabiliti by Ewan · · Score: 1

    You've been able to grow the AIX LPARS dynamically in various ways for a couple of years now, adding CPU and memory is just a case of clicking an arrow in the Java management gui used.

    AIX5.2 does require the allocation of an entire CPU, hard drive, and network adapter to each partition though, and this is the real problem - there's no hardware virtualisation.

    The AIX5.3 update and the soon to be released Power5 hardware supports 10 partitions per CPU, and virtual disks and ethernet adapters.

    Ewan

  42. Doing it with HP for years... by Anonymous Coward · · Score: 0

    Nice feature, but hardly a big breakthrough. HP-UX has had the same capability for years, except HP calls it "partitioning".
    Too Little, Too Late to help save Solaris and Sun....

  43. Whoo hoo. by Moderation+abuser · · Score: 1

    Only 30 years to catch up with IBM. Have they even caught up? Sorry if I don't get over excited about this.

    --
    Government of the people, by corporate executives, for corporate profits.
  44. Sounds like IBM's venerable VM by intertwingled · · Score: 1

    Zones kind of sound like IBM's VM (Virtual Machine) OS, except that with VM, you could run a different operating system in each "zone".

    --
    -- SKYKING, SKYKING, DO NOT ANSWER.
    1. Re:Sounds like IBM's venerable VM by grigori · · Score: 1

      Kind of like, but not the same. Read carefully: Zones give you one copy of Solaris, but private zones/containers within them. You don't get the overhead of virtual machines, or of multiple OSes all serving clock ticks every 10ms!

  45. Solaris is for real users by mveloso · · Score: 5, Insightful

    After reading the comments, it seems blatantly obvious that most /. readers don't work in the industry.

    Zones fix some really important, real world problems. The main problem that it will solve for organizations is migration of apps from development to production boxes.

    In Real Life (and in the well run organizations) there's a separation between dev, production, and sometimes test. There are a number of implications for this, the main one being this: there are usually two sets of hardware (or three, if there's a separate test area).

    Now with a few moments of thought, you can see the problem. By moving the software from place to place you introduce changes. Change is bad, because change causes software to break. How many times have you had problems with your apps because you forgot to change some config file, or a machine name, or whatever?

    With zones you don't need to change the machine to change the machine. You just copy your zone from one machine to another. Ta-da! You have no problem with changes impacting your app. If the app worked in test, it'll work in production. Do you need to mirror production in a test environment? Just create a bunch of zones and do it. You don't have to change the IP addresses or anything.

    Need to migrate your app to a bigger box? Heck, just move your zone. No need to reinstall your app, synchronize and adjust all the configs, and repoint everyone and everything to the new box. Move it from that ultra 5 in the basement to the big cat in the data center.

    I suppose you'll be able to auto-migrate zones between machines in later releases, in a form of cross data-center load balancing. Hey, that E450 is unused, let's move the web server there on the fly.

    Just another step on the road to virtualization...

    1. Re:Solaris is for real users by Anonymous Coward · · Score: 1, Insightful

      > After reading the comments, it seems blatantly obvious that most /. readers don't work in the industry.

      > Zones fix some really important, real world problems.

      I don't think anyone was saying the problems are not real.

      What people are saying is that the solution already existed in about half a dozen different forms, and well, welcome to the club Sun, but you aint got something new or unique, so why the hype.

      The examples you give.. yeah, been there, done that, actually some 3 years ago now, based on x86 hardware running FreeBSD, really no need for Solaris for that.

    2. Re:Solaris is for real users by Ozric · · Score: 1

      I sure hope the backend systems and down stream apps that your dev and testing "zones" connect to know how to keep the production data from your dev stuff.

      You know ..

      Just picking .. looks good on paper tho.

  46. Been there, done that... FreeBSD did jails first.. by TheTitan · · Score: 0, Flamebait

    Is anyone else tired of Sun's copycat software development? Sun, go home, your development efforts aren't interesting to those who think outside of the box anymore. FreeBSD has had jails since March 2000. Sure jail(8) never had a marketing department come along to spiff up the name, but your software is of no interest anymore.

    Now, what Sun can do with an Opteron, on the other hand, is of interest.

    T SUN PLZ BE SHIPPINK ME A 32 WAY OPTERON TEST BOX K PLZ THX

    --
    -- Sean Chittenden
  47. Re:Nice addition to the existing domain capabiliti by Oh-es-eX · · Score: 1

    As far as I know can you only partition the SUN boxes named here before, into board partitions so most of the time 4 CPU's minimum and the rest that is on the removable system board. While on IBM boxes you can partition on CPU level. However what CPU is powerfull enough to run 10 partitions and still perform well on all of these. The future will bring them and I like these new baby that IBM is cribbing... I'm happy I can work with both systems at the moment and type this on a MAC. Do I miss Microsoft these days? eeeh no not really are they still in Business these days?? Someone please tell me.

  48. Re:FUD (OT) by ozbird · · Score: 1
    The Install CD must be for the occasional sysadmin who needs a bib to protect his shirt from drool.

    I have the DVD-ROM version, you insensitive clod! :-)
    Actually, I have both CD and DVD media; I'd like to use the latter (no need to swap CDs in the middle of the installation), but I was foiled:
    • The Sun DVD drives we have at work don't support booting from DVD media without a firmware patch - potentially an interesting Catch-22 situation... (Usually you'll have either a Solaris CD and/or a Sun pre-installed image on the hard disk, but that should have been picked up before shipping the drives.)
    • The DVD boots into "drool mode" - I have not found a way to bypass this and jump to the equivalent of CD 1 yet.
    • I tried to "drool" my way through it in case they have improved the installation with Solaris 9 - no such luck.


    • At this point, I cut my losses and went back to the traditional CD1 installation. >:-|

      If you know how to boot the DVD into CD1 mode, please let me (and others) know in a reply to this thread - thanks!
  49. Sun Discovers LPARs... by frank_adrian314159 · · Score: 3, Funny

    IBM said to be reeling after this 30-year late counterpuch. News at eleven.

    --
    That is all.
    1. Re:Sun Discovers LPARs... by jsavit · · Score: 3, Informative
      Actually, this is more like IBM's VM, but not exactly like that either - read the posts here and you'll see it does NOT create virtual machines (each of which requires its own operating system). LPAR gives you only a small and fixed number of OS contexts on a box: a z900 goes up only to 16! Virtualization via VM lets you have hundreds or several thousand, Zones lets you have hundreds or several thousands with less overhead.


      FWIW: LPARs were introduced by IBM in 1987 (plus or minus a year), and it was imitating Amdahl's MDF feature.

  50. Re:Nice addition to the existing domain capabiliti by sad_ · · Score: 1

    you can do hardware partitioning on hpux machines as well, depending on the model.

    --
    On a long enough timeline, the survival rate for everyone drops to zero.
  51. Re:FUD (OT) by Mr.+Piddle · · Score: 1

    If you know how to boot the DVD into CD1 mode...

    Sorry, the only DVD drive I own is my PlayStation. Sun generally provides decent documentation, so I'm sure there is a way, somewhere (e.g., docs.sun.com, sunsolve.sun.com, google groups, etc.).

    --
    Vote in November. You won't regret it.
  52. not a big deal as Virtuozzo is several years old by kreazy · · Score: 1

    Why this is considered as a big deal? With the presence of such technologies as VMWare, Bochs, UML and especially Virtuozzo/Linux I'm really not understanding such a hype about Zones.

  53. How is this similiar to user-mode Linux and jails? by Billly+Gates · · Score: 1

    What are the differences between the 3?

    I am curious if I could write some assembly level programs in a virtual state or isolated area that will be bullet proof. As you all know you can screw up and freeze your system if you make a mistake in assembly.

    I would love a way to write assembly level programs for computer science virtualized so if it freezes it wont take down the whole system.

    I multitask alot and use FreeBSD which unfortunatly does not have a journaling filesystem.

    User mode Linux seems promising and I was wondering if Solaris Zones or BSD jails had this type of functionality? They seem great for security but if there were VMware like would be a plus for development work as well.

    --
    http://saveie6.com/
  54. Sun is still toast by Anonymous Coward · · Score: 1, Funny

    This new feature ought to be called a "twilight zone".

  55. Re:Nice addition to the existing domain capabiliti by welsh_sean · · Score: 1

    On HP you have hard partitions (NPARS) (on rp8400, rp7410 and Superdome) and VPARS (virtual partitions) on any machine running 11i+ The VPARS do have some dynamic reconfigurables - the last time I used them which was just over a year ago you could reassign CPUs on the fly but playing with RAM required a reboot.

    We used this technology to enable us to use one Superdome for both QA and DR. We had three hard partitions and split each of these into two VPARS. We could assign most CPUs and most of the RAM to the QA VPARS but if we needed to invoke DR then we could switch it over so that most of the resources were in the DR VPAR (this would of course require a reboot). A bit mind boggling but very cool and it worked flawlesly!

    It's very weird have two sessions on two VPARS which are on the same machine (a machine without harware partioning like an N-class) and rebooting one partition in one session whilst Oracle runs flawlessly on the other!!!!

  56. Virtual routers anyone? by sd3 · · Score: 2, Interesting

    It would be interesting to virtualize the machine down to the IP level. You could run separate instances of routed (or whatever) in each virtualized machine's space, then have a router cloud-in-a-box. Now you can play games like changing the data or error rate on certain links, bring routers up or down, etc.

    Yes, I know you could use NISTnet but this would allow you to do other things. Besides, with a virtualized machine you get (?) more assurance that things are correct down to the Nth level.

    I tried running four instances of UML on a 2400XP+ machine and it's usable, though not necessarily for 100Mb/s traffic. Doesn't give you much in the way of network depth though. Tried four instances of VMware+NetBSD on a P-III/500 and it's painful. Am currently struggling with Xen now, but I'm ready to try a userland VM instead.

  57. Re:How is this similiar to user-mode Linux and jai by Anonymous Coward · · Score: 0

    >I multitask alot and use FreeBSD which unfortunatly does not have a journaling filesystem.
    A lot of people screw up unfortunately and think that FreeBSD needs a journaling filesystem. FreeBSD has a reworked UFS (dubbed UFS2) and soft-updates which is functionally equivalent to what most people think of as journaling (it guarantees ordered writing of metadata). (Please don't give me shit about ext3 doing data journaling either because I've never found someone that actually uses that because of the insane penalties.)

    Check out softupdates, you can enable them with softdep in the options to mount the UFS slice.

    Brandon

    --I'm an AC, been that way for 4 years, and PROUD OF IT!

  58. Re:How is this similiar to user-mode Linux and jai by cos(0) · · Score: 1

    Are you still using Windows 9x/Me?

    Any other recent operating system has proper memory and resource protection. The worst your assembly program will do is cause the operating system to terminate it.

    The assembly language is not a gateway to rampant system destruction.

  59. Re:Nice addition to the existing domain capabiliti by jedi63 · · Score: 1

    You can only add existing CPU's to the LPAR. You have to take the system down to add the h/w.

  60. zones allow s/w to failover onto another zone by jedi63 · · Score: 1

    Not only can zones allow you to consolidate the dev, test, training, and staging environments that usually needed to be on several boxes, but, now you can have additional uptime with your s/w application on the production server. If the app crashes or locks up another zone can take over. Its not HA because you are still relying on a single box, but, it is a way to provide more uptime for an app. BTW, don't consolidate production with those other non-production functions. It really is never a good practice to place too many variables and potentials for OE onto the production server.

  61. linux zones by cogagni · · Score: 1

    SW soft has a commercial product that creates zones for linux. they are called virtual environemnts - VEs - and they all share the same kernel - check it out http://www.sw-soft.com/. it is light weight.