Oracle 21c New Feature - Database Nest (DbNest)

Database Nest ("DbNest") is infrastructure that enables a database instance to run in a protected and virtualized environment by isolating operating system resources and filesystems for CDBs and PDBs.  The feature is implemented as a Linux-specific package that provides hierarchical containers called "nests".  A CDB resides within a single parent nest, while each PDB resides in individual child nests created within the parent.

Linux processes in a PDB nest have their own process ID (PID) number spaces and cannot access PIDs in other nests.  This prevents a malicious user in one database from accessing other databases on the same system.

DbNest is considered a security feature, and is detailed in the Oracle Database Security Guide (ref).  Without DbNest, it is possible that users of one PDB can somehow access another PDB’s data in memory, since both PDBs are part of the same CDB that owns all of the processes.  (While this is an unheard-of problem, it is theoretically possible).  To prevent accidental data exposures like this, DbNest uses Linux resource isolation, namespaces, and control groups.

Nests are created and managed automatically.  You (the DBA) don't need to worry about it.  All you need to do is enable the feature and let Oracle do the work.  That said, it's always good to understand what's happening.

A PDB nest is automatically closed when that PDB is closed, and automatically deleted when that PDB is unplugged or deleted.  All nests are deleted whenever the CDB is shutdown, and recreated on startup: the CDB nest is started with the CDB, and each PDBs' nest is started when that PDB is opened.

The maximum number of nests per CDB is 4,000 and the maximum number per host is 8,142.  These limits are not a problem for on-prem deployments: Enterprise Edition with the Oracle Multitenant option only allows 252 PDB per CDB, which means a total of 253 nests.  Deploying on Oracle engineered systems (EE-ES) allows up to 4,096 PDBs so you have the ability to create more PDB than nests.

DbNest can be enabled or disabled using initialization parameter DBNEST_ENABLE (ref).  A value of NONE disables the feature.  The only other allowable value CDB_RESOURCE_PDB_ALL enables the feature.  Once enabled a separate nest is created for the CDB and for each mounted PDB.  Nests are automatically created for any future PDB you create. 

The only other init.ora parameter related to DbNest is DBNEST_PDB_FS_CONF (ref).  This is optional and often not set.  It is used to define an optional configuration file where you can list all locations that should be mounted or blacklisted inside the nest.  The parameter is optional because DbNest automatically mounts all filesystems required by the CDB nest and each PDB nest.  This parameter can be set at the CDB but not PDB level.

DbNest relies heavily on the Linux cgroup feature, which has been part of every Linux kernel since 2.6.24.  Each cgroup is a named subset of processors and memory, and each Oracle instance can be bound or constrained to its assigned cgroup. 

There is no cgroup on a Linux server by default, so every Oracle instance on the server shares all of the processors.  In most on-prem deployments this sharing is what you want, because dividing resources means each instance has access to fewer resources and runs slower.  In cloud deployments, however, it may be advantageous to isolate instances from each other in order to meet service level objectives and ensure predictable performance. 

The Linux cgroup feature can be thought of as a type of instance caging.  Actually, Oracle 11g R2 introduced a separate feature called Instance Caging which basically lets you limit an instance to some number of CPUs, but you cannot tell it which CPUs as you can with cgroup.  Instance Caging requires Database Resource Manager, but cgroup does not.  Instance Caging allows you to oversubscribe CPU resources so that on a server with 16 Hyperthreads and 3 databases you might allocate 8 threads to each of your three databases.

Instance Caging and cgroup are not perfect solutions for Oracle Multitenant databases.  All PDB in the CDB will share the same processors and memory chips.  To that end, Oracle introduced DbNest.  DbNest is basically an implementation of cgroup for Oracle Multitenant.

The cgroup feature is automatically used by DbNest.  Basically, if you are going to setup DbNest for a multitenant database, then you don’t need to manually setup cgroup.  It happens automatically.