Chapter 7. Zones in Solaris 11

Solaris 11 zones have some significant differences from Solaris 10 zones. Some features are no longer there, but others have replaced them. Zones in Solaris 11 are a few steps closer to being completely independent virtual machines in their own right yet still retain the performance and interoperability advantages of zones.

Taking things to the next zone

Zones in Solaris 11 come with some new utilities, new features, and some mandatory differences in basic setup and usage. Key new features covered in this chapter are:

• zonestat

• New zone capabilities, including zone beadm

• anet, the new auto-configuring zone network interface type

• How to preconfigure zones

• Read-only zones, aka immutable zones

New zone utilities

The most useful new utility is zonestat. Similar in principle to the other *stat tools, it will give you a repeating snapshot over time of relevant resources being used, where you tell it the interval between each output. It was actually possible already to get per-zone statistics with prstat -Z, but that forced you to look at "ps" style output as well.

In contrast, the new zonestat tool has many more options, and its output is focused purely on entire zone-level usage. See the manpage for full details, but in general terms, zonestat lets you see each zone's total CPU, memory, and network bandwidth usage.

It is possible to run the zonestat command within a zone, but you will only see statistics for that zone.

An additional tool of interest is zonep2vchk. The purpose of this tool is to check for potential difficulties when transferring a physical zone (that is, a global zone) "2" a virtual one. Its default mode is to look at installed services to see if they are compatible...

New zone capabilities

Solaris 11 zones have a few extra capabilities, some of which have been awaited for a long time now.

• Zones can now be NFS servers. There's not much more to be said about that, other than "it's about time!".

• zoneadm can now do shutdown and reboot, in addition to halt.

• Zones can now run snoop successfully, and safely, if the zone has its own private network interface. While it was technically possible to allow snoop in a zone under Solaris 10, it was necessary to take some dubious and unsafe shortcuts to do so.

Thanks to the drastic rewriting of how the Solaris 11 kernel handles networking, this does not mean that the zone needs its own dedicated physical network interface. It is possible to allocate a virtual NIC (VNIC) device to a zone, and safely allow the zone to use snoop, without letting it see traffic from other zones that may share the same physical interface.

• It is also possible to allow a zone to manage its own IP address. It is even possible for a zone to use DHCP...

Fast zone creation via clone

In Solaris 10, you may or may not have been taking advantage of zones on ZFS, and thus, zone cloning.

In Solaris 11, since you must give each zone its own ZFS subfilesystem, you may as well take advantage of cloning if you plan on creating more than one zone. This is particularly relevant given that, by default, all zones are created with the same small set of packages, but it can still take quite a while to initialize. In contrast, when using zoneadm -z newzone clone oldzone, installing a new zone takes only 10 to 15 seconds.

Tip

The one drawback of using the zoneadm clone is that you cannot clone a currently running zone. However, if you plan ahead and create your first running zone from a non-running template zone, you will take up no extra disk space and will also have a template immediately available for your next zone.

If you use cloning to create a zone, the new ZFS root filesystem will initially be a writable ZFS clone of the old zone filesystem, presuming...

Automatic Network Interfaces – the anet resource

The old net resource for zones has been somewhat deprecated, in favor of a new name, anet. Technically, it stands for Automated Network Interface, but it also adds a few new capabilities that could have been added to the regular net resource but were not.

Zones now, by default, have a network type of exclusive rather than shared. This may be a little misleading to Solaris 10 admins since that previously implied an entire physical network interface would be dedicated to the zone. Happily, this is no longer required.

Solaris 11 zones make use of the new Virtual Network Interface, aka VNIC. It is now standard procedure for a zone to have its own VNIC, which is in some ways similar to the concept of a virtual interface under VMware or VirtualBox. The VNIC device usually has its own automatically generated Ethernet address and so can be a fully functional direct member of your network, including the use of DHCP, VLAN tagging, and anything else...

Preconfiguring zones

Zone configuration has three basic levels to it, which can be automated at one or all levels.

Sysconfig information

In Solaris 10 zones, it was possible to preconfigure sys-unconfig type information, (hostname, name service, and so on) by prepopulating /etc/sysidcfg before first boot. In Solaris 11, there is a similar concept, but with a very different implementation. First of all, as the relevant file is now XML-based, you are best off using the sysconfig create-profile subcommand to generate it for you. Secondly, you are now expected to pass the location of the file as an argument to zoneadm install. The following examples will hopefully make this clearer:

• zoneadm -z newzone install -c /path/to/sysconfig.xml

• zoneadm -z newzone clone -c /path/to/sysconfig.xml oldzone

The two crucial things here are that you must give the full path to the XML file, and that if you are cloning, you must give the old zone name last on the command line.

Initial zonecfg defaults

There is only...

Immutable zones

In Solaris 10, it was common to have zones created with read-only versions of /usr, shared from the global zone. This had assorted benefits, one of which was to disallow overwriting of system binaries from the zone.

Solaris 11 zones offer the option of having fixed, or immutable zones. The typical configuration will lock down all files other than those under clearly volatile filesystems such as /tmp and /var/tmp (including local filesystems such as /export/home).

It is possible to choose from three different types of immutable configurations. They have varying degrees of inhibition, but all of them have the following features in common:

• It is no longer possible to install IPS packages

• Persistently enabled SMF services cannot be changed

• SMF manifests cannot be added from the normal locations

The three individualized types of immutable zones, set through the file-mac-profile property of zonecfg are as follows:

• flexible-configuration: This is similar to the prior sparse-zone configuration...

Summary

Zones in Solaris 11 are even closer to the capabilities of a fully autonomous VM, yet with the performance efficiencies of a shared kernel. With the extremely fast creation and boot capabilities they provide, (not to mention the zero incremental license cost), there is very little reason to use a full-blown VM solution any more. In fact, even if you still need one, you can now use Oracle VM for free. Support for it costs extra but is based on physical number of CPU sockets rather than number of VMs.

With the added observability of zonestat, plus the greater autonomy of zone-local Boot Environments, you can now have a virtual datacenter on a single commodity priced box. This all comes without the barriers of inter-VM communication that full virtualization solutions tend to bring along with them as baggage.