Kernel OpenVZ

1 kernel

1.1 virtualization , isolation
1.2 resource management

1.2.1 two-level disk quota
1.2.2 cpu scheduler
1.2.3 i/o scheduler
1.2.4 user beancounters


1.3 checkpointing , live migration

kernel

the openvz kernel linux kernel, modified add support openvz containers. modified kernel provides virtualization, isolation, resource management, , checkpointing. of vzctl 4.0, openvz can work unpatched linux 3.x kernels, reduced feature set.

virtualization , isolation

each container separate entity, , behaves largely physical server would. each has own:

files
system libraries, applications, virtualized /proc , /sys, virtualized locks, etc.


users , groups
each container has own root user, other users , groups.


process tree
a container sees own processes (starting init). pids virtualized, init pid 1 should be.


network
virtual network device, allows container have own ip addresses, set of netfilter (iptables), , routing rules.


devices
if needed, container can granted access real devices network interfaces, serial ports, disk partitions, etc.


ipc objects
shared memory, semaphores, messages.

resource management

openvz resource management consists of 4 components: two-level disk quota, fair cpu scheduler, disk i/o scheduler, , user bean counters (see below). these resources can changed during container run time, eliminating need reboot.

two-level disk quota

each container can have own disk quotas, measured in terms of disk blocks , inodes (roughly number of files). within container, possible use standard tools set unix per-user , per-group disk quotas.

cpu scheduler

the cpu scheduler in openvz two-level implementation of fair-share scheduling strategy.

on first level, scheduler decides container give cpu time slice to, based on per-container cpuunits values. on second level standard linux scheduler decides process run in container, using standard linux process priorities.

it possible set different values cpus in each container. real cpu time distributed proportionally these values.

in addition above, openvz provides ways to:

set strict cpu limits, such 10% of total cpu time (--cpulimit);
limit number of cpu cores available container (--cpus);
bind container specific set of cpus (--cpumask).

i/o scheduler

similar cpu scheduler described above, i/o scheduler in openvz two-level, utilizing jens axboe s cfq i/o scheduler on second level.

each container assigned i/o priority, , scheduler distributes available i/o bandwidth according priorities assigned. no single container can saturate i/o channel.

user beancounters

user beancounters set of per-container counters, limits, , guarantees, meant prevent single container monopolizing system resources. in current openvz kernels (rhel6-based 042stab*) there 2 primary parameters (ram , swap, a.k.a. physpages , swappages), , others optional.

other resources memory , various in-kernel objects such inter-process communication shared memory segments , network buffers. each resource can seen /proc/user_beancounters , has 5 values associated it: current usage, maximum usage (for lifetime of container), barrier, limit, , fail counter. meaning of barrier , limit parameter-dependent; in short, can thought of soft limit , hard limit. if resource hits limit, fail counter increased. allows owner detect problems monitoring /proc/user_beancounters in container.

checkpointing , live migration

a live migration , checkpointing feature released openvz in middle of april 2006. makes possible move container 1 physical server without shutting down container. process known checkpointing: container frozen , whole state saved file on disk. file can transferred machine , container can unfrozen (restored) there; delay few seconds. because state preserved completely, pause may appear ordinary computational delay.