Dave, I find a major improvement with Zones Parallel Patching: http://blogs.sun.com/patch/date/20090617
Now our only limit is available I/O on UFS filesystems. The maintenance window is much more tolerable on modest sun4v container systems. Since ZPP serves our needs, I haven't seriously looked at update-on-attach as of yet. We also use "pca --noreboot" to apply non-reboot patches ahead of time, this further minimizes the window needed for single-user patching. pca has to interpret the READMEs, but this has worked perfectly for us so far. Also, I have a few Solaris 10 systems with ZFS root -- some for over a year now. With U8 and recent patches, Live Upgrade with zones and ZFS-based BE's is very useful, and IMHO relatively un-dramatic compared to the old days of LU. For LU, I usually patch with "lumount" and "pca -R", rather than feeding luupgrade - works great. If you can somehow get to UFS or ZFS root, then you can reduce your maintenance time like this, even if you don't go with LU. As for OpenSolaris, I am cautiously optimistic. It should be straightforward to maintain local package repositories, which is critical -- we must be able to complete a patch run entirely from our local cache, without the internet. IPS analysis performance has improved, but I think there is still much to be done before it's ready for production. Will it be better than SysV packages? I believe so -- we have merely grown comfortable with the SysV devils that we know. =-) We do not use OpenSolaris on any server environments yet, just workstations and test VM guests. I should say that I don't really love the GUI package and update tools, but this is less important for my needs. Good luck... I hope that you will stick with Solaris. It may be easier to patch Linux (I'm a user since 1992), but then it seems that one ends up patching more frequently. Sun's coherent integration and testing add a lot of value. -cheers, CSB
