Abstract: A mechanism is provided for implementing multi-level resource control in operating system partitions. In one implementation, one or more non-global partitions may be established within a global operating system environment provided by an operating system. Each non-global partition may have one or more projects executing therein, and each project may comprise one or more processes. Each non-global partition may have associated therewith a first resource limit. This resource limit indicates how much of a particular resource has been allocated to the non-global partition as a whole. Each project executing within a non-global partition may have associated therewith a second resource limit. This limit indicates what amount of the particular resource allocated to the non-global partition has been allocated to that project. By setting multiple limits in this manner, it is possible to control resource allocation at multiple levels.

Abstract: A mechanism is disclosed for system accounting in an operating system environment that has been partitioned into a global zone and one or more non-global zones. Each zone is associated with one or more processes that execute in association with that zone. Each zone contains a separate system accounting log file. When a process terminates, the process invokes an exit function implemented by a kernel that controls all of the zones. In response, the kernel determines in which zone the process executed. The kernel adds, to the system accounting log file of the zone in which the process executed, a first record that indicates accounting information for the process. The kernel also may add a second record to a global system accounting log file. The first record may contain details specified by a non-global zone's settings, while the second record may contain different details specified by the global zone's settings.

Abstract: The present invention provides, in one embodiment, a multi-level service model operating system environment that may be partitioned into a global zone and one or more non-global zones to isolate processes from processes executing in association with other non-global zones under control of a single kernel instance. In one embodiment, the multi-level service model includes a virtual platform layer and an application layer. The virtual platform layer may include services and resources for supporting the zones, which can be made accessible to the zones in the form of a virtual platform. The application layer may comprise the non-global zones, including an application environment for maintaining a runtime state for the zone's processes and any zone-constructed objects, such as network connections and shared memory segments. In one embodiment, control and management of non-global zones can be provided by a system of states and transitions.

Abstract: A mechanism is disclosed for selectively providing mount information to processes running within operating system partitions. In one implementation, a non-global operating system partition is created within a global operating system environment. A file system is maintained for this non-global partition. This file system comprises zero or more mounts, and may be part of a larger, overall file system. When a process running within the non-global partition requests information pertaining to mounts, a determination is made as to which partition the process is running in. Because the process is running within the non-global partition, only selected information is provided to the process. More specifically, only information pertaining to the mounts that are within the file system maintained for the non-global partition is provided to the process. By doing so, the process is limited to viewing only those mounts that are part of the non-global partition's file system.

Abstract: In accordance with one embodiment of the present invention, there is provided a mechanism for managing and controlling global visibility of resources in zones within an operating system controlled by a single kernel instance. Embodiments enable isolation and virtualization of processes within a single image of an operating system, without requiring implementation of hardware support (such as the introduction of an additional privilege level) to isolate privileged programs, and without multiple instances of an operating system or operating system kernel for some applications.

Abstract: A mechanism is disclosed for virtualizing system statistics in an operating system environment (OSE) that has been partitioned into a global zone and one or more non-global zones. The OSE comprises processes and system resources. Each process is associated with a zone. Each resource may be associated with a statistical data structure. Statistical data about a resource is stored in that resource's statistical data structure. Each statistical data structure is associated with at least one zone and one or more key values. A process may specify key values. The kernel may select a set of statistical data structures that are associated with the process' associated zone. The kernel may return, to the process, a list of statistical data structures in the set, or statistical data contained in one of the set's statistical data structures that matches the process-specified key values.

Abstract: A mechanism is provided for implementing multi-level computing resource scheduling control in operating system partitions. In one implementation, one or more partitions may be established within a global operating system environment provided by an operating system. Each partition may have one or more groups of one or more processes executing therein. Each partition may have associated therewith a partition share value, which indicates what portion of the computing resources provided by a processor set has been allocated to the partition as a whole. Each group of one or processes may have associated therewith a process group share value, which indicates what portion of the computing resources allocated to the partition has been allocated to that group of processes. Once properly associated, the partition share value and the process group share value may be used to control the scheduling of work onto the processor set.

Abstract: A global operating system environment provided by an operating system kernel may have one or more non-global partitions. These non-global partitions serve to isolate processes running within each non-global partition from other non-global partitions within the global operating system environment. A non-global partition may have associated with it a resource pool (e.g. processors, memory, etc.). The resource pool sets forth the resources that are available to the non-global partition. Processes running within the non-global partition are limited to utilizing only the resources in the resource pool. By associating a resource pool with a non-global partition in this manner, it is possible to easily and conveniently set limits on what is available to a non-global partition.