In the emerging landscape of dynamically allocated data center resources, there are two methods for re-provisioning a server dynamically: hard-drive provisioning and PXE provisioning.

Hard-drive provisioning requires a management system to recreate a disk image on the client system being re-provisioned. PXE (preboot execution environment) provisioning - a.k.a. "pixie booting" - requires the client to grab a boot image off the network, in the same way it might grab a network address via DHCP.

Each approach has its merits. The most obvious merit in the provisioning-to-disk scenario is that the dependency of client on provisioning system ends once a disk image is complete. Network problems or provisioning system failures have no effect on the client system’s basic ability to function through power cycles and restarts.

The most obvious merit of the PXE system is its agility: restarting a server, and moving 20MB or so over the network and into its RAM to get it booted up, is orders of magnitude faster than copying 2GB of data to disk and booting. Combined with server virtualization, PXE offers maximum agility.

That speed of deployment has significant risk-mitigation implications in a couple of other scenarios: system security management and disaster recovery.

In system security, pixie booting provides a way to propagate secured or patched system images as rapidly as possible, but also to keep pre-patch versions available for equally swift rollback in the event of unforeseen problems with the patches. (This has implications outside the data center too, of course. Pixie-booted workstations would offer security advantages similar to those of a Windows or X-terminal, but would offer the benefit of actually continuing to work if the network went down - as long as no reboot was required.)

In disaster recovery, pixie booting allows conservation of a precious shared resource during the emergency: bandwidth. Re-provisioning a room full of servers all at once using disk imaging alone could clog a data center network and choke to a halt a WAN link to some alternate location. Sprinkle some pixie dust, and bandwidth requirements for re-provisioning drop by 99%!

The risk? Let’s leave aside the risk of the network being unavailable when a system needs to reboot. After all, if that is the case, the server with an image and the server without look the same, functionally. No, the real risk is in the PXE provisioning system itself, of course. Such a system must replicate the same kind of reliability and redundancy found in core network services like DHCP and DNS. If it is the foundation of server operations, it simply cannot fail.