Slashdot Mirror
Experiences with Replacing Desktops w/ VMs?
E1ven asks: "After years of dealing with broken machines, HAL incompatibility, and other Windows frustrations, I'd like to investigate moving to an entirely VM-based solution. Essentially, when an employee comes in in the morning, have them log-in, and automatically download their VM from the server. This gives the benefits of network computing, in that they can sit anywhere, if their machine breaks, we can instantly replace it, etc, and the hope is that the VM will run at near-native speeds. We have gigabit to all of the desktops, so I'm not too worried about network bandwidth, if we keep the images small. Has anyone ever tried this on a large scale? How did it work out for you? What complications did you run of that I probably haven't thought of?"
Plus, on a LAN using thinclients will be just as fast, visually, as a local PC. Hell, I play video's over my RDP thinclients and it works quite well.
You talk better than you fool!
LTSP.ORG does somthing similar. You run X clients on a common "server" and view it with an X server on almost anything with 64 megs or more of memory.
First off, I don't think VM'ing your desktops is the answer. Current VM's really dumb down the hardware. You lose 3D, sound, and most of them run a bit slower than native (some quite a bit slower). Couple that with the size of most VM images (my Vista image is about 12GB) and you're really looking at a poor solution.
Here's what you should be thinking about:
- Get some kind of desktop management suite like Altiris. You can push software deployments easily, and it's very easy to lock machines down to the point where users can't fsck them up. I've consulted for companies that do this with hundreds of desktops and it's a very robust, reliable system.
- Go with a thin client setup like Citrix or Terminal Server. Users run nothing on their local hardware. Instead, everything runs on the big server. Downsides are similar to VM's (thin clients are notorious for very lightweight support for anything but the most basic sound and graphics) but you are at least spared the massive network thrashing of hundreds of users logging on and pulling down VM images at 8AM every morning.
- If it's users messing up machines that you're worried about, you might want to consider a solution by Clearcube. They take away everything except the keyboard, mouse, and monitor. The guts of the PC reside in a server rack in what is essentially a PC on a blade. The blades are load balanced and redundant, so swapping them out is a breeze. And users *can't* load software on them because there's no USB ports, no floppy drive...nothing! Unless you allow them to download it from the Internet, *nothing* is going to get on those machines if you don't want it to.
VM's make sense for server consolidation. I don't think they've yet gotten to the point where desktops run on them as a form of protection or reliability. There's too many other solutions that work better and have fewer downsides. The problem here isn't Windows per se, it's the fact that your workstations aren't locked down properly to prevent your users from doing stupid stuff in the first place. Fix that and suddenly you'll find a Windows workstation environment isn't the hassle it once was.
In the end they will lay their freedom at our feet and say to us, Make us your slaves, but feed us. - Fyodor Dostoyevsky
Because Sunrays are really sucky. take it from a former Sun Microsystems instructor. They really are. You're better off with a Linux solution, for Multiple reasons (not going to go into all of them, now. Just research it. Start with cost-factor and go from there).
Come on, you're going to have to give some additional information than that. We use Sun Rays quite a bit in our classrooms and labs and if you have the bandwidth and a good server on the other end, you're in the money. Sessions can be keyed to an access card and will follow you around the campus. If a Sunray breaks down, just swap in a new one and the session continues exactly as you left off. Pull your card, come back in a week, and pick up exactly where you left off. Everything resides on the server. No maintenance required at all on the client side.
What version of the Sun Ray server software were you using that made it so "sucky"? From my experience, they worked great for us. The only downside we had is that streaming video over Citrix to the Sun Rays didn't work so hot. However, streaming video natively from the Sun Ray server to the thin clients worked fine so the problem there was probably with Citrix Metaframe.
Sun has also recently upgraded the Sun Ray thin clients so they have gigabit ethernet, plus they now hsve a more complete end-to-end solution that will allow you to run Windows apps on your Sun Ray (in addition to all the Solaris/Unix apps) thanks to their Tarantella purchase. You'll still need some Terminal Server licenses, but you'll save on the Citrix.
You could try calling the local Sun reps and see if they'll give you a demo. They did that for us - drove 6 hours to our workplace and set up a server and clients to demonstrate it for us.
Citrix (or another similar product) is exactly what he should be looking into. Downloading entire disk images over a network is just a pain in the ass everytime someone boots. However Citrix isn't the solution to all things, yet it beats VMs for most practical applications.
See, that's the big negative point in the entire setup. The bootup time is a pain in the neck, but people can live with that easily. They'll fetch their cups of coffee, have the morning conversation with coworkers and will return about 10 minutes after their machines have booted up. The real issue is the server getting hammered every morning, slowing these boottimes as more machines get added to the network.
I can hear it now: set up a second server, set up a third... etc etc. Yes, set up a bunch of servers that do nothing all day but hand out images, and don't forget about the backup servers (you don't want one of those servers to crash in the morning taking out the entire accounting department). I'm seeing an entire rack of machines at this point doing nothing but handing out images, wired up to really expensive network gear, doing nothing really useful. Don't get me wrong in this last statement, the usefulness of this construction is that you can easily exchange pc's and images not having to worry about hardware, software installed on each users pc, etc. But there's a lot of more cost-effective ways to achieving something that works similar.
Take that budget for those image servers, and backup servers, VM-software licenses, and networkgear, and buy a single server and a good backup mechanism (or a backup server in failover). Spend some time on setting up profiles and think about what software is present on all machines. Take an image of every machine you install differently, and copy that to the server. Buy software like Citrix (or anything else resembling it) to have special applications available at one server (think backups here), and you have a pretty decent solution that doesn't hammer your network/servers every morning and gives you a headache by 10am because some people aren't getting their images.
I've seen the concept of VM images on a server, and I've seen people get bitten by it because they didn't forsee the amount of storage and network traffic involved. Most of these people didn't have a need for such an elaborate solution. Hell, I've seen half a serverfarm run vmware because "it was a good way to virtualize systems, and make things easily interchangable" while those people would've been much more satisfied with a "simpler" failover solution (note those quotes, denoting that failover also requires thought, but usualy ends up being a cheaper solution hardware wise).
On top of it all, using VMs for desktop operating systems uses up a lot of resources. You're running an operating system, that runs software that runs another operating system. Some would say that it's hardly noticeable, but why waste the resources? You'll make todays hardware run like last years, which for most applications is not an issue, but most likely you're going to run last years hardware like hardware from two years ago because you'd have to invest in new desktops for the entire company otherwise.
Let's talk mobility for a moment. Imagine your salesman with his laptop and flashy UMTS (or whatever standard they've cooked up) connection on the road. He's going to want to be able to check his mail on the road, so he'll have to get an image over a connection that can hardly manage streaming video... Nope, you're going to give him his operating system, install his software and pray to god he doesn't send too many large documents over that very expensive UMTS connection. That sort of starts breaking the principle of having images f
For Windows, use roaming profiles and default installations. For Linux, rsync works quite well for the base OS (say, a staggered start time at night based on IP), with OpenLDAP doing auth and home dirs stored on central server(s) and mounted via NFS. New system setup becomes a knoppix CD, partition the new drive, format partitions, mount them, rsync the distribution to the new machine, chroot, and setup boot loader. You could of course script all of this, and this is very similar to what I do for kiosk systems (Linux/Firefox setup), except the kiosks don't change, so it's just a big tarball via sftp instead of rsync. You could also do tarballs, and keep the last few versions as backups in case you screw something up. If the hardware is identical, use the distribution of your choice, but if there are several different systems, you may want to use one with good hardware detection (like knoppix).
--That's the point of being root, you can do anything you want, even if it's stupid.
I think I have to disagree. Most of the better gigabit nics out there support PXE boot. Get a small boot loader image going. If these will all be on the same lan segment, at boot time it will grab the latest loader image, boot the small loader (~2MB). The loader can then boot the full OS image.
You can then just capture or encapsulate the computing session to an image file. It's not a full virtualized environment, as you still get the benefits of the cpu horsepower at the workstation, but if corruption occurs ou just roll back the session file. I think.
This is how Windows hibernation functions in a nutshell, just dumps RAM to a file I think. I haven't tried this in practice, but it should work.
Karma: Chameleon (mostly due to the fact that you come and go).
Actually, with VMware workstation you can keep base images on the workstation itself and load only user's plugins / redo stuff over the network. That's what we do and we don't see any network hit on 100 Mbps LAN. This gives you ability to run free (as in beer) Linux distro on all your workstations, which enormously helps with PC support issues compared to any Windows version. With a bit of clever scripting, KDE session retrieves all the necessary stuff from MySQL backend and users have their workstation (Windows, Linux, whatever) running full screen in no time. With good PC hardware (which is dirt-cheap these days) noone can tell that what they see and work on is VM.
.edu so we get really nice discounts on VM licenses).
Granted, for large network this solution is probably too expensive (we are
You don't need to "carefully" do anything. Folder Redirection in Windows was created just for the task. It's a feature that was introduced with Windows 2000. Beyond that you can use SMS and custom office installs to have everything configured properly everytime someone logs in. Mandatory profiles ensure that everything stays clean and spyware free. Which weaknesses are you referring to?
Beyond that I'll go and say that this approach is bomb proof and by redirecting files on to the servers which requires surprisingly little overhead you ensure that when users float from machine to machine they have all their application preferences and data. Settings can very from machine to machine with different version of software and whatnot but again, SMS will fix that.
I think we can all agree this is not a good use of virtualization. It would be very resource intensive and a simpler PXE solution already exists. With PXE you don't even have to have all the same hardware, just the proper drivers. SMS will take it from there installing the rest of the third party apps whatever they may be. Can be done from start to finish in under 30 minutes which is about how long it takes to fully restore an image. Of course over a gigabit link the time might be reduced but Windows will take a good 10 - 15 minutes to install over the network so it wouldn't be unreasonable for everything else to take another 15 minutes depending on how much there is. I know in my basic setup with Windows and Office its about 20 minutes give or take depending on processing speed and quality of hardware.
My friend had setup Windows for his girlfriend as guest OS under Linux host. He was using VMWare. His girlfriend was forced to use IE to access her University Intranet. Also she needed M$Office for documents from profs. The notebook was constantly plagued by malware/spyware/etc making it barely usable.
My friend installed Linux (Gentoo one) and VMWare Workstation. Inside the VMWare he installed the OEM Windows off the notebook. State of Windows - fully updated and with M$Office installed - was saved on backup image. In guest Windows, all work was done on SMB/CIFS drive of host Linux.
The only problem was video performance - e.g. macromedia flash animations at times were making the notebook to melt. Also there were some sporadic network problems - mostly attributed to poor Windows network stack implementation. (IOW, the network problems occurring with normal Windows installation under VMWare were occurring more often. E.g. Windows DHCP client was at times failing to get address from host Linux. That IE thing was at times failing to load pages properly or simply hanging. The usual WinXP/IE problems.)
Advantages were clear. Spyware/malware got to notebook? - recover from backup image. Something crashed? - data are most likely are Okay on host Linux hard drive. Also, gradually girlfriend ha been taught how to use Linux and how to get around the University Intranet with Linux and Firefox/Konqueror. Though most documents she used still required M$Office under Windows.
All hope abandon ye who enter here.
This is a different kind of a VM. .NET and Java run application logic with their own type of VM that allows their applications to interact with the OS, in many cases, just like any other native application. VMware and other VM solutions attempt to emulate an entire host computer to run an operating system, which can then run applications. These applications are constrained to accessing only the things available to them in their operating system and cannot interact with the host operating system, except through emulated networks and devices.
.NET simply make the native operating system's 3D APIs available to its applications. A full VM solution would have to implement a "virtual" 3D-capable video card that a guest OS would be able to use, and then find a way to hook that emulated video card up to a variety of real video cards. This is considerably more difficult.
Java and
VMware has actually had 3D support for a while, but it's been painfully slow. The latest versions do make some attempt at using hardware 3D acceleration through the host operating system. I'm not sure how well at works, though.
Server != Desktop
Servers are much more likely to be network I/O bound, physical I/O bound, or CPU bound. VMware has done a lot of work to create accelerated network and disk drivers that communicate directly with the host VM software, avoiding the overhead of emulating hardware. Additionally, most software that runs on a server spends a lot of time processing things in user mode with occasional system calls to transfer chunks of data, so the VM overhead is very low for those applications.
Desktops are much more demanding on I/O. Applications with a GUI are constantly context switching between user mode and the kernel in order to update the screen, display pretty animations, get keyboard / mouse input, etc. Just drawing the graphics for a 1280x1024x24bpp display is an immense data transfer burden that has to be routed through the VM, often a few dozen pixels at a time rather than a bulk transfer. Even with accelerated drivers, the virtual framebuffer still has to be copied / multiplexed into the real one. Even small increases in latency are very user-perceptible, so a VM will seem more "sluggish" than a physical machine.
That's just for business applications. Once a user starts playing audio (it'll be uncompressed 44/48khz PCM data by the time it gets to the VM!), streaming video (no access to the hardware YUV conversion or scaling!), or trying to do anything that needs 3D acceleration, the full impact of the virtualization will be felt.
-- Ironically, the spell checker in Konqueror wanted to change "VMware" to "Vampire"