1. Operating System Level Virtualization Reza Farivar

2. Types of virtualization Native, full Hardware assisted Para-virtualization OS level – Containers – Jails – Chroot – Zones – Open-VZ  Virtuozzo

3. Native and Full Virtualization the virtual machine simulates enough hardware to allow an unmodified "guest" OS (one designed for the same CPU) to be run in isolation. Examples: – VirtualBox – Virtual PC – Vmware – QEMU – Win4Lin – XEN/Virtual Iron

4. Hardware enabled virtualization the virtual machine has its own hardware and allows a guest OS to be run in isolation. Intel VT (IVT)‏ AMD virtualization (AMD-V)‏ Examples: – VMware Fusion – Parallels Desktop for Mac – Parallels Workstation

5. Partial virtualization the virtual machine simulates multiple instances of much (but not all) of an underlying hardware environment, particularly address spaces.

6. Paravirtualization the virtual machine does not necessarily simulate hardware, but instead (or in addition) offers a special API that can only be used by modifying the "guest" OS. Terminologies – Hypervisor, hypercall – Enomalism Examples: – XEN, KVM, Win4Lin 9x

7. Operating system-level virtualization virtualizing a physical server at the operating system level, enabling multiple isolated and secure virtualized servers to run on a single physical server. Examples: – Parallels Workstation – Linux-VServer, Virtuozzo – OpenVZ, Solaris Containers – FreeBSD Jails – Chroot ?

8. Comparison

9. Thinner Containers, better performance

10. 10 What is the Trade-Off?

11. 11 Feature Comparison HypervisorContainer Multiple Kernels X Load Arbitrary Modules X Local AdministrationAll Live Migration OpenVZ Live System UpdateX Zap

12. 12 Xen 3.0 Guest VM I/O Path Process to Guest OS Guest OS to IDD Resource Control Driver Domain Map Virtual Devices CFQ for disk HTB for network Security Isolation Hypervisor Access Physical Level PCI Address Virtual Memory Resource Control Hypervisor Allocate Resources Schedule VMs Schedules All VMs Guest VM & IDD Scheduled Two levels scheduling in Guest

13. 13 VServer 2.0 Guest VM Security Isolation Access to Logical Objects Context ID Filter User IDs SHM & IPC address File system Barriers Resource Control Map Container to HTB for Network CFQ for Disk Logical Limits Processes Open FD Memory Locks Optimizations File-level Copy-on-write I/O Path Process to COS Scheduler Single Level Token Bucket Filter preserves O(1) scheduler

14. 14 VServer Implementation 8,700 lines across 350+ files – Leverage existing implementations – Applied to Logical Resources Not architecture specific – MIPS, ARM, SPARC, etc.. – Low Overhead

15. 15 Guest Comparison Xen 3.0VServer 2.0 Level of VirtualizationPhysicalLogical Resource ControlHTB, CFQ, etc Scheduler2-levels: Hyp + Guest1-level I/O Path3 transfers2 transfer

16. 16 Configuration KernelLinuxVServer 2.0Xen 3.0.4 Version2.6.16.33 DistributionFedora Core 5 File systemIndependent LVM Partitions SchedulerO(1)O(1)+TBFCredit MachineHP DL360 G4p CPU2 x 1 core Xeon with 2MB L2 Network2 Port GbE Memory4 GB Hardware System Software

17. 17 Disk I/O: Write

18. 18 CPU & Memory Performance

19. 19 Performance at Scale - UP

20. Solaris Zones

22. Types of Zones

23. Zone Daemons

24. Zone File Systems

25. Zones Networking

26. Zones Resource Capping

27. OpenVZ Requires both the host and guest OS to be Linux Claim: There is only a 1–3% performance penalty for OpenVZ as compared to using a standalone server The basis of Virtuozzo Containers – By Parallels – Claim: 300% more virtual servers than hypervisor solutions

28. OpenVZ: Less overhead

29. OpenVZ: LAMP Throuput

30. OpenVZ: LAMP Response Time

31. OpenVZ Components

32. OpenVZ Kernel Virtualization

33. OpenVZ Kernel Resource management

34. OpenVZ Checkpointing

35. OpenVZ Control Interface

36. LXC Linux Containers

37. Better isolation as compared to a chroot (chroot jail). Low overhead. LXC uses minimal resources in terms of RAM and hard drive space without the overhead of installing a guest OS in a virtual machine ( VMWare / VirtualBox / KVM ). Applications and services (servers) run at native speed. There is support for Linux containers in libvirt. Linux containers work well with btrfs. No special hardware is required, runs on 32 and 64 bit processors. Linux containers are Open source. Unlike XEN or OpenVZ, no patch is required to the kernel. What are LXC Linux Containers?

38. Create control group filesystem as the root user. # mkdir -p /cgroup # mount none -t cgroup /cgroup Add to fstab so it will be there after a reboot. # vi /etc/fstab and add line below none /cgroup cgroup defaults 0 0 Applications to install. # apt-get install libvirt-bin debootstrap We need to download and install this pkg. lxc_0.7.2-1_amd64.deb # dpkg -i lxc_0.7.2-1_amd64.deb LXC Linux Containers on Ubuntu with CentOs Clients

39. # Create a container # lxc-create -f /path/to/{CONTAINER_NAME}/main/config/file -n {CONTAINER_NAME} # lxc-create -f /etc/lxc/lxc-centos.conf -n centos Create a rootfs directory # mkdir /var/lib/lxc/centos/rootfs Copy files you worked on earlier. # cp -r /home/yourhomeidirectory/LXC/Centos5-x86_64/* /var/lib/lxc/{CONTAINER_NAME}/rootfs # cp -r /home/yourhomeidirectory/LXC/Centos5- x86_64/* /var/lib/lxc/centos/rootfs Create this file for creating and setup default devices for your containers. # vi /usr/local/bin/lxc-config and add information below, also only needs to be run once for every new container you create. Step1: Create a container

40. # cd /var/lib/lxc/CONTAINER_NAME}/rootfs/ # cd /var/lib/lxc/centos/rootfs/ # /usr/local/bin/lxc-config # fix /dev Chrooting into the rootfs file system for centos # chroot /var/lib/lxc/centos/rootfs/ Setup root password for your container. # passwd root Start or Remove some services from running # chkconfig sshd on # chkconfig httpd on # chkconfig xinetd off # chkconfig sendmail off When finish type exit to finish chroot session. Step2: Chroot session

41. Destroy container and files # lxc-destroy -n {CONTAINER_NAME} # lxc-destroy -n centos Start container # lxc-start -n {CONTAINER_NAME} init # lxc-start -n centos init Stop container # lxc-stop -n {CONTAINER_NAME} # lxc-stop -n centos Connect to tty console # lxc-console -n centos -t 1 doesn’t seem to work for me. Check your configuration # lxc-checkconfig List containers # lxc-ls If you receive this error lxc-ls warning, got bogus unix line, reinstall uml-utiilities # sudo apt-get –reinstall install uml-utilities Is it RUNNING or STOPPED # lxc-info -n {CONTAINER_NAME} # lxc-info -n centos Step3: Delete container and files