Run container-based workloads on LinuxONE Virtual Servers for VPC

IBM LinuxONE is an enterprise-grade Linux server that combines IBM’s enterprise-system expertise with the openness of the Linux operating system. Its unique architecture is designed for mission-critical workloads and is sustainable, secure, and scalable.

IBM LinuxONE Virtual Servers for Virtual Private Cloud (VPC) provides a virtual server as a service, a simple way to get started with IBM Z-based virtual servers in the cloud. IBM Cloud provides stock images that you can use to create LinuxONE-based virtual servers.

In this tutorial, you'll learn how to run your container-based workloads on a LinuxONE Virtual Servers instance with PostgreSQL.

Note: You can reuse many of the IBM Cloud entities that you create in this tutorial in the related tutorial on IBM Hyper Protect Virtual Servers for VPC. Be sure to preserve them so you do not have to create them twice.

Prerequisites

• Before you begin this tutorial, be sure to review IBM Cloud official documentation for the latest information about IBM virtual private servers.
• Ensure you have a valid IBM Cloud account.

Note: In this tutorial, you will use the IBM Cloud user interface to complete the steps. Advanced users can also use the IBM Cloud VPC CLI, IBM Cloud VPC REST APIs, and the corresponding Terraform provider.

The IBM Cloud UI menus can change over time. If you have any questions about the UI or documentation, contact the IBM Hyper Protect Accelerator at: hpa@ibm.com.

Estimated time

It should take you approximately 15 minutes to complete this tutorial.

Part 1. Create and configure an IBM LinuxONE Virtual Servers for VPC instance

To run a container-based workload on IBM LinuxONE Virtual Servers for VPC, you must first create and configure your virtual server instance. Complete the following steps:

Step 1. Create a LinuxONE Virtual Servers instance

1. Log in to IBM Cloud.

2. In the left menu, click VPC Infrastructure > Virtual server instances.

   

3. On the "Virtual server instances for VPC" page, click the Create button.

4. Select a location for your virtual server.

   

5. Enter a name for the instance you are creating; for example, mypostgresql.

   

6. Optional: Enter a resource group and tags for your virtual server. Click the information icon to learn more.

Step 2. Select an image and profile

1. In the Image and profile section, click Change image.
2. In the Architecture section, click IBM Z, LinuxONE s390x architecture.
3. From the image list, select your preferred image. This tutorial uses ibm-ubuntu-22-04-3-s390x-1.

4. Click Save.

   

5. Click Change profile.

6. In the "Select an instance profile" window, select your preferred profile. This tutorial uses bz2-1x4.

   

7. Click Save.

Your Image and profile section should look like the following image.

Step 3. Add an SSH key to your instance

To use SSH to log in to your Virtual Servers instance you need to provide an SSH public key as input. If you have one already, you can use it here. If you need to create a new one, complete the following steps:

1. Click Create an SSH key.
2. Enter a name, resource group, and (optionally) tags for your key.
3. In the SSH key type field, select either RSA or ED25519. (Click the information icon to learn more abour SSH key types.)
4. For the SSH key input method, select Generate a key pair for me.
5. Click Save private key and save the file.

6. Click Save public key and save the file.

   

Step 4. Storage and networking

Note: Under normal circumstances, you should consider creating additional storage for production workloads running on your Virtual Servers instance. However, in this tutorial, you will not need to add additional volumes.

1. Optional: In the Networking section, click Create VPC and enter the details for your additional workload storage. It is not necessary to add storage for this tutorial.
2. Click the Virtual private cloud menu and select VPC (default) or the VPC that you created. Note: You can create a new VPC at any time by clicking Create VPC in this section.

3. In the Networking interfaces section, click the edit (pencil) icon, choose the appropriate subnet, and update details as required.

   

Step 5. Advanced options

For this tutorial, leave all advanced options as the default. To learn more about the advanced options, see the Virtual Private Cloud documentation, including:

• User data
• About VPC Instance Metadata
• Creating dedicated hosts and groups
• About placement groups
• Host failure recovery policies

Step 6. Create a virtual private cloud

1. When you have entered all required information in each of the sections, in the Summary pane, click Create Virtual Server.

   

2. Confirm that the virtual server instance is starting, similar to the following image.

   

3. To check the progress of the instance start-up, right-click on the newly created instance and from the menu, select Open Serial Console. The virtual server instance boot log opens.

   

4. Click the name of the virtual server instance to view its details, similar to the following image.

   

Step 7. Enable public access to the Virtual Servers instance

The Virtual Servers instance has a private IP address, which is all that's required if you only need to access this instance from another virtual server instance in the same VPC subnet. However, if you need to access the instance from outside the VPC, you need to attach a floating IP address (or "public IP") to the instance.

1. In the IBM Cloud menu, click VPC Infrastructure > Floating IPs. The Floating IPs for VPC page opens.

   

2. Click Reserve. Confirm the location details and provide a meaningful name for the floating IP. When you are finished entering the floating IP details, click Save.

   

3. On the Floating IPs for VPC page, right-click on the reserved IP you just created and bind the IP to the Virtual Servers instance. This binding will enable you to use SSH to access the Virtual Servers instance using this public IP.

   

Step 8. Use SSH and the floating IP to access the virtual server instance

1. In the IBM Cloud menu, click VPC infrastructure > Virtual server instances. In the instance table's Floating IP column, you'll see the public IP address that you just created.

2. Use the IP address and your SSH private key to access the virtual server instance.

   

You have now successfully created your own instance of IBM LinuxONE Virtual Servers for VPC.

Part 2. Run a container-based workload

You'll now run a container-based PostgreSQL workload on the virtual server instance you created and configured. To run the workload, complete the following steps:

Step 1. Install Docker and Docker Compose

Now that you have your instance of LinuxONE Virtual Servers running, you're ready to run a PostgreSQL workload. To give you the ability to run the same workload later on IBM Hyper Protect Virtual Servers for Virtual Private Cloud (VPC), you'll use the container approach.

The Virtual Servers instance image does not come with a container runtime so in this example you'll use Docker to run the workload.

If you do not already have Docker and Docker Compose installed, refer to the Docker documentation to install on LinuxONE Virtual Servers. (Note the s390x architecture for LinuxONE Virtual Servers. See the Docker APT repository documentation.)

After you install Docker, you need to install Docker Compose. Note that IBM Cloud Hyper Protect Virtual Servers for VPC internally supports Docker Compose (for a single OCI container) or Podman Play (for multi-OCI containers). Docker Compose will enable you to easily switch to Hyper Protect Virtual Servers at a later stage.

1. Add Docker's official GNU Privacy Guard (GPG) key using the following commands.

   sudo apt-get update
   sudo apt-get install ca-certificates curl gnupg
   sudo install -m 0755 -d /etc/apt/keyrings
   curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
   sudo chmod a+r /etc/apt/keyrings/docker.gpg
   

2. Add the repository to APT sources.

   echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
   sudo apt-get update
   sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
   curl -SL https://github.com/docker/compose/releases/download/v2.23.0/docker-compose-linux-s390x -o /usr/local/bin/docker-compose
   sudo chmod +x /usr/local/bin/docker-compose
   docker-compose --version
   

   

Step 2. Use Docker Compose to start the PostgreSQL workload

When you've set up your container runtime, you can now bring up the workload.

1. Create a file called docker-compose.yaml with the following contents. (Note: Choose a password as the value for the POSTGRES_PASSWORD environment variable, ensuring that you maintain required YAML formatting.)

   services:
   postgresql:
   image: docker.io/library/postgres:12@sha256:429c57f9ae8f379601df6df7448b0c2c8df4da23d7ba2cb57fee8da8f262eda0
   ports:
    - "5432:5432"
   environment:
    - POSTGRES_HOST_AUTH_METHOD=trust
    - POSTGRES_PASSWORD=passw0rd
   

   

2. Run the docker-compose up -d command to bring up the environment.

   

Step 3. Access the PostgreSQL service from within the Virtual Servers instance

When the PostgreSQL container is running, you can check whether the service is accessible from within the Virtual Servers instance.

1. Install the following packages so that you can use the psql utility.

   sudo apt install postgresql-client-common
   sudo apt install postgresql-client
   psql -h localhost -p 5432 -U postgres
   

2. Check that you can access PostgreSQL.

   

Step 4. Access the PostgreSQL service from outside the Virtual Servers instance

You've confirmed that your PostgreSQL instance is accessible locally. Now you will confirm that you can access it from outside the instance. You can either create another Virtual Servers instance or use your laptop to connect to this PostgreSQL instance through the floating IP and port.

You are not currently able to connect to this instance externally because you have not yet opened the inbound traffic. To open the instance to inbound traffic, you will create a new security group:

1. In the IBM Cloud menu, click VPC Infrastructure > Networks > Security groups.

   

2. Click Create and enter details for the new security group. Enable traffic to access the instance using port 5432, similar to the following image.

   

3. When you have added all your security group details, click Save to create the security group.

4. In the IBM Cloud menu, click VPC Infrastructure > Virtual server instances.

5. Click the mypostgresql instance. In the Network interfaces, add the newly created security group. In the following image, the postgres security group has been added.

   

6. Try to access your PostgreSQL instance from outside the instance. If you have set up your security group with the correct port, you should now be able to access the instance.

   

Congratulations! You have now successfully set up the container-based PostgreSQL service on a LinuxONE Virtual Servers for VPC instance and are able to access it externally. You can now create your database tables and columns, and use the database as the backend for any application.

Note: You will run the same workload that we used in this exercise in the related Hyper Protect Virtual Serves for VPC tutorial. Store the docker-compose.yaml file that you created. You can also reuse other IBM Cloud entities, such as the virtual private cloud, subnets, and security group.

Summary

In this tutorial, you set up and ran the IBM Cloud LinuxONE Virtual Servers for VPC service. You can now quickly spin up a SUSE or Ubuntu-based LinuxONE virtual machine in a few minutes. With this environment, you can test, develop, and experiment with your workloads, and you have the option to use SSH to access the environment. You can also run workloads such as PostgreSQL as a systemctl service (although not covered in this tutorial) or interactively as a container-based workload.

Next steps

Complete the related tutorial to get the same workload running while protected by IBM Secure Execution Confidential Computing technology. That tutorial uses IBM Hyper Protect Virtual Servers for VPC, which is strongly recommended for production environments, ensuring the integrity and confidentiality of boot images, multi-party contracts, and other features.

To continue learning about IBM Cloud, LinuxONE, and virtual private servers, check out the following resources:

• IBM LinuxONE Virtual Servers for VPC
• IBM Hyper Protect Virtual Servers
• Confidential computing with LinuxONE.