There are several ways to virtualize machines from the different closed source variants as VMware ESXi and Windows Hyper-V virtualization to open source varies as Xen and Kernel-based Virtual Machine (KVM). There is also another way to virtualize parts of an operating system to increase versatility and be able to use more of the system’s resources in a more efficient way. LXC (Linux Containers) is a lightweight virtualization that is run on top of the existing operating system by encapsulating applications that is inside the container. LXC works so the kernel of the Linux system is shared by the containers that run next to each other without much knowledge of each other. In that way it can be more resource efficient than virtualizing the entire Linux kernel several times for different applications in a traditional guest to host environment. Many data centers today are already using some variant of virtualization in their production environment, it may then be interesting to examine if there are some other methods that result in better performance for chosen application and power savings when hosts can be turned off. That is why this project has carried out a field study to examine how LXC performs when the host system is virtualized in a hypervisor environment. An organization might want to migrate from a hypervisor environment to a lightweight virtualization environment that is based on containers. The work has been done by doing experiments using two different software to examine I/O to determine if LXC is affected by being nested inside ESXi. The study begins with a small background study to obtain information that will give relevant information from previous done work in relevant fields. The study was conducted with the use of the experimental method to be able to answer the hypothesis and the projects questions. The questions that was answered in the project was: How much degradation of the file system's read and write speeds arises when LXC is nested in ESXi? Does it affect the file system's ability to read and write to disk when there are restrictions on available resources? The result of the experiments show that LXC performs close to equal of the bare metal systems, with a 2 percent loss as a minimum and a maximum of 11 percent in write and read ability to/from disk. When LXC is intertwined with ESXi there is an up to 15 percent loss in write and read ability excluding the loss the hypervisor adds. When restricting the resources for a container down to one processor core and two gigabytes of primary memory experiments show that there was a 3 to 15 percent loss in write and read ability from the disk

<p>Virtualisering av servrar är på frammarsch och ser ut att bli ett mer och mer frekvent inslag i datacenter världen över. När virtualisering ska införas i en organisation eller företag är det därför viktigt att veta om sina behov och därifrån sedan välja en virtualiseringslösning som passar.Denna rapport presenterar en jämförelse av de tre hypervisorer som är ledande på marknaden för virtualisering; VMware ESXi, Citrix XenServer och Microsoft Hyper-V. Den första delen av jämförelsen innefattar granskning av funktionalitet hos hypervisorerna, så som stöd för gästoperativsystem och hårdvarustöd. Den andra delen av jämförelsen mäter prestandan på de tre hypervisorerna på gästoperativsystemen Windows Server 2008, Suse Linux Enterprise Server 11 och Ubuntu Server 8.04 LTS.Prestandatester utförs med SysBench och de komponenter som testas är processor, RAM-minne och hårddisk. Resultaten visar på varierande resultat för de olika hårdvarukomponenterna på de olika systemen som testats.</p>

Η παρούσα διπλωματική έχει σαν σκοπό τη διερεύνηση της τεχνολογίας του Cloud Computing και της τεχνολογίας της Virtualization που την στηρίζει. Παρουσίαση της ιστορίας και μια τεχνική παρουσίαση των δυνατοτήτων και των καταβολών των τεχνολογιών. Αναφέρονται πρακτικές εφαρμογές που μπορούν οι συγκεκριμένες τεχνολογίες να εφαρμοστούν και τους σκοπούς που θα εξυπηρετήσουν. Επίσης γίνεται μια πιο αναλυτική παρουσίαση δυο προγραμμάτων (Xen Hypervisor – για το επίπεδο της Virtualization, Eucalyptus – σαν πλατφόρμα για τη δημιουργία IaaS Clouds). Παρουσιάζονται επίσης σύντομοι οδηγοί για την εγκατάσταση ενός Cloud, καθώς και το configuration μαζί με τους λόγους που χρησιμοποιήθηκε. / The scope of this thesis is to study the technology of Cloud Computing and the Virtualization technology that is supporting it. A presentation of the history, a technical overview and the origins of these technologies. There are mentioned some fields that the specified technologies could apply and the purposes that they would serve. On the third chapter, a more detailed presentation of two pieces of software is given (Xen Hypervisor – for the Virtualization Layer, Eucalyptus – as the platform to create IaaS Clouds). In the end quick how-to guides are described on the procedure to install a Cloud, the configuration and the reasons of the specific set up as well.

abstract: With the software-defined networking trend growing, several network virtualization controllers have been developed in recent years. These controllers, also called network hypervisors, attempt to manage physical SDN based networks so that multiple tenants can safely share the same forwarding plane hardware without risk of being affected by or affecting other tenants. However, many areas remain unexplored by current network hypervisor implementations. This thesis presents and evaluates some of the features offered by network hypervisors, such as full header space availability, isolation, and transparent traffic forwarding capabilities for tenants. Flow setup time and throughput are also measured and compared among different network hypervisors. Three different network hypervisors are evaluated: FlowVisor, VeRTIGO and OpenVirteX. These virtualization tools are assessed with experiments conducted on three different testbeds: an emulated Mininet scenario, a physical single-switch testbed, and also a remote GENI testbed. The results indicate that network hypervisors bring SDN flexibility to network virtualization, making it easier for network administrators to define with precision how the network is sliced and divided among tenants. This increased flexibility, however, may come with the cost of decreased performance, and also brings additional risks of interoperability due to a lack of standardization of virtualization methods. / Dissertation/Thesis / Masters Thesis Engineering 2016

Följande arbete syftar till att få en överblick av hur servervirtualisering ser ut hos privata företag i Sverige samt för att få en djupare förståelse för hur det fungerar rent tekniskt. I utredandeavsnittet presenteras information om hur servervirtualisering fungerar samt information om ett antal aktörer på virtualiseringsmarknaden. Avsnittet tar dessutom upp vilka fördelar servervirtualisering medför ur ett kostnads och miljöperspektiv. Genomförandeavsnittet presenterar intervjuerna som har genomförts genom personliga besök på IT-företag och företag med en intern IT-avdelning. Intervjuerna behandlar frågor om hur, vad och varför de virtualiserar sina serversystem.

Data centres and other infrastructures in the field of information technology suffer from the major issue of ‘server sprawl’, a term used to depict the situation wherein a number of servers consume resources inefficiently, when compared to the business value of outcome obtained from them. Consolidation of servers, rather than dedicating whole servers to individual applications, optimizes the usage of hardware resources, and virtualization achieves this by allowing multiple servers to share a single hardware platform. Server virtualization is facilitated by the usage of hypervisors, among which Xen is widely preferred because of its dual virtualization modes, virtual machine migration support and scalability. This research work involves an analysis of the CPU scheduling algorithms incorporated into Xen, on the basis of the algorithm’s performance in different workload scenarios. In addition to performance evaluation, the results obtained lay emphasis on the importance of compute intensive or I/O intensive domain handling capacity of a hypervisor’s CPU scheduling algorithm in virtualized server environments. Based on this knowledge, the selection of CPU scheduler in a hypervisor can be aligned with the requirements of the hosted applications. A new credit-based VCPU scheduling scheme is proposed, in which the credits remaining for each VCPU after every accounting period plays a significant role in the scheduling decision. The proposed scheduling strategy allows those VCPUs of I/O intensive domains to supersede others, in order to favour the reduction of I/O bound domain response times and the subsequent bottleneck in the CPU run queue. Though a small percentage of context switch overhead is introduced, the results indicate substantial improvement of I/O handling and fairness in re-source allocation between the host and guest domains.

The purpose of master’s thesis is to project virtualization solution together with replication of the servers. Thesis is divided into the three parts and that it theoretical, analytical and projection part. In analytical part there are basic information about virtualization technologies, in analytical part there is analysis of the present status of the company and mainly about status of the IT infrastructure and in the end projection part there is realization of the virtualization solution from choosing the right type of cluster to choosing hardware solution.

Der gleichzeitige Betrieb mehrerer Gast-Betriebssysteme auf einem einzigen physischen Rechner unter einem Host-Betriebssystem ist eine leistungsfähige moderne Entwicklung. Bekannte Beispiele sind VMware für die IA32-Architektur sowie das Betriebssystem z/VM und die PR/SM-LPAR Einrichtungen der zSeries-Architektur. Die Nutzung eines Betriebssystems als Gast bedingt einen Leistungsverlust. Die als Partitionierung bezeichnete Zuordnung von Systemressourcen zu den einzelnen Gast-Betriebssysteme ist schwierig, wenn eine dynamische Anpassung an sich ändernde Lastprofile erforderlich ist. Diese Probleme lassen sich mittels Erweiterungen der Hardwarearchitektur adressieren, sowie durch Softwarestrukturen, welche diese Erweiterungen nutzen. Die Erweiterungen der Hardwarearchitektur gehen über das hinaus, was auf heutigen Rechnerarchitekturen wie IA32 oder Mips verfügbar ist. Der vorliegende Beitrag erläutert den optimalen Betrieb von Gast-Betriebssystemen und die begleitenden Partitionierungsmöglichkeiten auf der zSeries-Plattform und beschreibt die zusätzlichen Hardware und Software-Einrichtungen, welche dies ermöglichen. / The capability to run multiple guest operating systems simultaneously on a single hardware platform is a powerful feature in a modern computer system.Well-known examples are VMware for the IA32-architecture and the z/VM operating system and the PR/SM-LPAR facilities of the zSeries architecture. Running an operating system as a guest results in a performance degradation. Partitioning of system resources and assigning them to individual guests may be difficult, if a dynamic adaptation to an ever changing load profile is required. Extensions of the hardware architecture and their exploitation by software permit to address these problems. Such extensions have not been available on existing architectures like IA32 or Mips. The following paper discusses the operation of guest operating systems and associated partitioning capabilities available in zSeries systems and describes supporting hardware and software facilities.

The thesis deals with the topic of complexity of current IT. As a result, the consolidation of servers using virtualization is the answer to permanently growing complexity of server infrastructure. The thesis summarizes the basic aspects of this issue, compares the contributions and tries to analyze problems which can emerge. Further, it points a way of consolidation journey, compares different types of virtualization and elaborates the contributions of virtualization for corporate IS/ICT and its flexibility of solution. It analyzes present state of the market with virtualization tools, describes and compares some products of the market key players and analyzes the new opportunities for virtualization, e. g. the virtual desktop infrastructure. At the end, it suggests an approach for consolidated project solution in practice and tries to show some basic steps which should not be omitted. Besides the complex view to the topic, the thesis also presents the contributions, risks and questions to be raised and, at least partly, answers these questions.

[EN] The availability of new processors with more processing power for embedded systems has raised the development of applications that tackle problems of greater complexity. Currently, the embedded applications have more features, and as a consequence, more complexity. For this reason, there exists a growing interest in allowing the secure execution of multiple applications that share a single processor and memory. In this context, partitioned system architectures based on hypervisors have evolved as an adequate solution to build secure systems. One of the main challenges in the construction of secure partitioned systems is the verification of the correct operation of the hypervisor, since, the hypervisor is the critical component on which rests the security of the partitioned system. Traditional approaches for Validation and Verification (V&V), such as testing, inspection and analysis, present limitations for the exhaustive validation and verification of the system operation, due to the fact that the input space to validate grows exponentially with respect to the number of inputs to validate. Given this limitations, verification techniques based in formal methods arise as an alternative to complement the traditional validation techniques. This dissertation focuses on the application of formal methods to validate the correctness of the partitioned system, with a special focus on the XtratuM hypervisor. The proposed methodology is evaluated through its application to the hypervisor validation. To this end, we propose a formal model of the hypervisor based in Finite State Machines (FSM), this model enables the definition of the correctness properties that the hypervisor design must fulfill. In addition, this dissertation studies how to ensure the functional correctness of the hypervisor implementation by means of deductive code verification techniques. Last, we study the vulnerabilities that result of the loss of confidentiality (CWE-200 [CWE08b]) of the information managed by the partitioned system. In this context, the vulnerabilities (infoleaks) are modeled, static code analysis techniques are applied to the detection of the vulnerabilities, and last the proposed techniques are validated by means of a practical case study on the Linux kernel that is a component of the partitioned system. / [ES] La disponibilidad de nuevos procesadores más potentes para aplicaciones empotradas ha permitido el desarrollo de aplicaciones que abordan problemas de mayor complejidad. Debido a esto, las aplicaciones empotradas actualmente tienen más funciones y prestaciones, y como consecuencia de esto, una mayor complejidad. Por este motivo, existe un interés creciente en permitir la ejecución de múltiples aplicaciones de forma segura y sin interferencias en un mismo procesador y memoria. En este marco surgen las arquitecturas de sistemas particionados basados en hipervisores como una solución apropiada para construir sistemas seguros. Uno de los principales retos en la construcción de sistemas particionados, es la verificación del correcto funcionamiento del hipervisor, dado que es el componente crítico sobre el que descansa la seguridad de todo el sistema particionado. Las técnicas tradicionales de V&V, como testing, inspección y análisis, presentan limitaciones para la verificación exhaustiva del comportamiento del sistema, debido a que el espacio de entradas a verificar crece de forma exponencial con respecto al número de entradas a verificar. Ante estas limitaciones las técnicas de verificación basadas en métodos formales surgen como una alternativa para completar las técnicas de validación tradicional. Esta disertación se centra en la aplicación de métodos formales para validar la corrección del sistema particionado, en especial del hipervisor XtratuM. La validación de la metodología se realiza aplicando las técnicas propuestas a la validación del hipervisor. Para ello, se propone un modelo formal del hipervisor basado en máquinas de autómatas finitos, este modelo formal permite la definición de las propiedades que el diseño hipervisor debe cumplir para asegurar su corrección. Adicionalmente, esta disertación analiza cómo asegurar la corrección funcional de la implementación del hipervisor por medio de técnicas de verificación deductiva de código. Por último, se estudian las vulnerabilidades de tipo information leak (CWE-200 [CWE08b]) debidas a la perdida de la confidencialidad de la información manejada en el sistema particionado. En este ámbito se modelan las vulnerabilidades, se aplican técnicas de análisis de código para la detección de vulnerabilidades en base al modelo definido y por último se valida la técnica propuesta por medio de un caso práctico sobre el núcleo del sistema operativo Linux que forma parte del sistema particionado. / [CAT] La disponibilitat de nous processadors amb major potencia de còmput per a aplicacions empotrades ha permès el desenvolupament de aplicacions que aborden problemes de major complexitat. Degut a açò, les aplicacions empotrades actualment tenen més funcions i prestacions, i com a conseqüència, una major complexitat. Per aquest motiu, existeix un interès creixent en per permetre la execució de múltiples aplicacions de forma segura i sense interferències en un mateix processador i memòria. En aquest marc sorgeixen les arquitectures de sistemes particionats basats en hipervisors com una solució apropiada per a la construcció de sistemes segurs Un dels principals reptes en la construcció de sistemes particionats, es la verificació del correcte funcionament del hipervisor, donat que aquest es el component crític sobre el que descansa la seguretat del sistema particionat complet. Les tècniques tradicionals de V&V, com són el testing, inspecció i anàlisi, presenten limitacions que fan impracticable la seva aplicació per a la verificació exhaustiva del comportament del sistema, degut a que el espai de entrades a verificar creix de forma exponencial amb el nombre de entrades a verificar. Front a aquestes limitacions les tècniques de verificació basades en mètodes formals sorgeixen com una alternativa per a completar les tècniques de validació tradicional. Aquesta dissertació es centra en la aplicació de mètodes formals per a validar la correcció del sistema particionat, en especial d del hipervisor XtratuM. La validació de la metodología es realitza aplicant les tècniques proposades a la validació del hipervisor. Per a aquest fi, es proposa un model formal del hipervisor basat en màquines de estats finits (FSM), aquest model formal permet la definició de les propietats que el disseny del hipervisor deu de complir per assegurar la seva correcció. Addicionalment, aquesta dissertació analitza com assegurar la correcció funcional de la implementació del hipervisor mitjançant tècniques de verificació deductiva de codi. Per últim, s'estudien les vulnerabilitats de tipus information leak (CWE-200 [CWE08b]) degudes a la pèrdua de la confidencialitat de la informació gestionada per el sistema particionat. En aquest àmbit, es modelen les vulnerabilitats, s'apliquen tècniques de anàlisis de codi per a la detecció de les vulnerabilitats en base al model definit, per últim es valida la tècnica proposada mitjançant un cas pràctic sobre el nucli del sistema operatiu Linux que forma part de l'arquitectura particionada. / Peiró Frasquet, S. (2016). Metodología para hipervisores seguros utilizando técnicas de validación formal [Tesis doctoral no publicada]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/63152 / TESIS