Today I got Xen live-migration and firewalls working at work. It was quite a battle. The end result seems to be that if the dom0 of physical machine is running Xen v. 3.0.2-2, the following iptables modules must NOT be loaded into the kernel, or our domU’s wouldn’t mount their root NFS filesystem:
iptable_nat ipt_REDIRECT xt_state
But now everything seems to work. Very nice.

At work, we are moving towards a netbooting solution for all of our servers. This process was started before I began working at Portalen. We run debian stable (3.1) and use a system called diskless. Recently, we started investigating the possibility of using Xen. We would like to netboot the dom0 and all of the xenU, allowing easy migration of virtual servers between physical hosts.

During the investigation, we were surprised to learn that diskless apparently has been deprecated in all releases after 3.1 in favour of another system called lessdisks.

In light of these news, I have been evaluating lessdisks as a replacement to our current diskless setup. However, it would seem that lessdisks doesn’t allow the diskless clients to maintain their own /etc — which is of paramount importance to us. So now we are considering our options. Betting on a deprecated system for our netboot solutions i obviously risky business, especially as the next stable release of Debian approaches.

Another idea, which I’m investigating, is using some kind of batch administration tool to install all the dom0 machines, and then do some NFS magic allowing all xenU’s to have a central location for their root fs and thereby avoid the netbooting issue alltogether.