Zones requiring network connectivity have at least one dedicated IP address. Non-global zones cannot observe each other's network traffic. Users in the global zone, however, are able to observe the functioning of processes in non-global zones. It is usually good practice to limit user access to the global zone to system administrators. Other processes and users should be assigned to a non-global zone.
Each zone is assigned a zone name and a unique numeric zone ID. The global zone always has the name "global" and ID "0." A node name is also assigned to each zone, including global. The node names are independent of the zone names.
Each zone has a path to its root directory relative to the global zone's root directory.
A non-global zone's scheduling class is set to be the same as the system's scheduling class. If a zone is assigned to a resource pool, its scheduling class can be controlled by controlling the pool's scheduling class.
Non-global zones can have their own zone administrators. Their authority is limited to their home zone.
The separation of the environments allows for better security, since the security for each zone is independent. Separation also allows for the installation of environments with distinct profiles on the same hardware.
The virtualization of the environment makes it easier to duplicate an environment on different physical servers.
ZFS is supported in Solaris 10 zones from the 6/2006 release and after.
The system administrator configures new non-global zones
zonecfg command, administers them
zoneadm and logs into them via
Zone state information can be viewed with
zoneadm list -iv from the global zone.
Non-global zones have one of the following states:
- configured: Configuration complete and in stable storage.
- incomplete: Installation or uninstallation underway
- installed: Configuration instantiated on system. Zone has no associated virtual platform.
- ready: Virtual platform established,
zschedstarted, IPs plumbed, filesystems mounted, zone ID assigned. No zone processes started yet.
- running: This state entered when zone
- shutting down: Zone being halted.
- down: Transitional state during zone shutdown.
Zone Control Commands
The following control commands can be used to manage and monitor transitions between states:
zonecfg -zzone-name: Interactive mode; can be used to remove properties of the following types:
fs, device, rctl, net, attr
Zones can be used to dynamically control resource allocations on a zone basis. This means that an application on a zone can be isolated and prevented from throttling other processes in other zones on the same server.
The following components may be included in a zone:
- Zone name
zonepath: Path to the zone root in the global zone's file space.
autoboot: Whether to start the zone automatically. (Note that the
svc:/system/zones:defaultservice needs to be running in SMF for this to work.)
pool: Associate the zone with a resource pool; multiple zones may share a pool.
net: Zone network interface
fs: File systems from the zone's /etc/vfstab, automounted file systems configured within the zone, manually mounted file systems or ZFS mounts from within the zone.
dataset: This allows a non-global zone to manage a ZFS file system.
inherit-pkg-dir: In a sparse root zone, represents directories containing packaged software that a non-global zone shares with the global zone. (Should not be used in a whole root zone.)
device: Devices that should be configured in a non-global zone.
rctl: Zone-wide resource controls such as
attr: Zone comments
zonecfg Interactive Mode
In interactive mode,
zonecfg can refer to either
a global scope or a specific resource. If no zone is specified in
zonecfg command, the scope is global
add subcommand is
used to specify a resource, the scope limited to that resource
cancel command is
The following subcommands are supported:
add: Add the specified resource or property to the configuration in the scope.
cancel: Ends the resource specification and returns to the global scope without retaining partially specified resources.
commit: Dump current configuration to disk.
create: In-memory configuration begun for a new zone. A
-ttemplate option specifies a template,
-Foverwrites an existing configuration, and
-bcreates a blank configuration.
delete: Destroy the specified configuration.
end: Ends the resource specification
exit: Ends the
export: Export the configuration in a form that can be used in a command file.
help: Context-sensitive help depending on the current scope
info: Display information about the configuration of the current scope.
remove: Remove the specified resource or property from the command scope.
revert: Return to the last state written to disk.
select: From the global scope, changes scope to the specified resource
set: Set the specified property to the specified value
verify: Verify the current configuration for correctness.
zonecfg:zone-name> add dataset
zonecfg:zone-name:dataset> set name=pool/filesys
zonecfg:zone-name> add fs
zonecfg:zone-name:fs> set directory=/mountpoint
zonecfg:zone-name:fs> set special=/dev/dsk/c#t#d#s#
zonecfg:zone-name:fs> set raw=/dev/rdsk/c#t#d#s#
zonecfg:zone-name:fs> set type=ufs
zonecfg:zone-name:fs> add options logging
zonecfg:zone-name> add inherit-pkg-dir
zonecfg:zone-name:inherit-pkg-dir> set dir=/package-home
zonecfg:zone-name> add net
(Examples of interface names include hme0 and bge0.)
zonecfg:zone-name:net> set physical=interface-name
zonecfg:zone-name:net> set address=xxx.xxx.xxx.xxx
zonecfg:zone-name> add rctl
zonecfg:zone-name:rctl> set name=resource-name
zonecfg:zone-name:rctl> add value (priv=priv-level,limit=#,action=action-type)
(See Resource Management for information about what sorts of values to use.)
There are two different zone models, sparse and whole root.
Sparse zones only contain a subset of the packages installed into
the root zone. Additional packages can be brought in using
resources. Each sparse zone requires about 100MB of free space
in the global file system. 40MB of free RAM are also recommended.
Whole root zones contain all required packages and also any optional Solaris packages that have been selected. The disk space required for whole root zones is as much as is required for a full installation. Whole root zones allow maximum configuration within the zone context.
Zone Creation Example
From within the global zone:
# zonecfg -z zone-name
(Note that the zone's root path cannot be on ZFS, though
that capability is coming.)
zonecfg:zone-name> set zonepath=/zone-root-path
zonecfg:zone-name> set autoboot=true
(Inside the non-global zone, the mounted loopback file system will
be readable and writable.)
zonecfg:zone-name> add fs
zonecfg:zone-name:fs> set dir=/mount-point
zonecfg:zone-name:fs> set special=/global-source-dir
zonecfg:zone-name:fs> set type=lofs
zonecfg:zone-name> add dataset
zonecfg:zone-name:dataset> set name=zone-pool/ZFS-filesys