Solaris Zones

||Solaris Zones||  

Zone is a small weight Virtualization concept which is development of the idea of BSD Jails which were designed by FreeBSD in 1999.
Zones provide a virtual operating system surroundings within single physical instance of Solaris 10. Application can run in an isolated and secure surroundings. The isolation prevents an application running in one Zone from monitoring or affecting an application running in a different zone. an additional important aspects of zones is that failing application such as one that would historically have leaked all the variable memory, or exhausted all CPU resources can be limited to only affect the zone in which it is running. This is achieved by limited the amount  of physical resources on the system that the zone can use.


Zones were designed in Oracle by Andrew Tucker and according to Oracle have better security integrated into the Operating System. To say that zones are great would be an under statement. They completely changed Unix World (Including security) and this why Solaris in the first true 21st  century Unix available on the marketplace.  It is not an accident that AIX 6 copied the concept from Solaris 10. 


It seems that zones are becoming the new powerful security model.  in lieu of one computer per server, one computer could have multiple jails for applications provided by zones, with each zone providing one service.  This is   for massive enterprises where "fight for privileges" between users & administrators is  acute. Not it can be resolved by granting root access to the zone with a specific application.


There is two types of zones

1. Global Zones
2. Non Global Zones

1. Global Zones :
 Global zone is your physical server. global zone is unique. We can not create multiple global zone. Global zone’s id is  always ‘0’  


2. Non Global zone:
         Zones create under global zones called as non global zone or local zone. We can create 6999 zones. It is same like Vmware in Windows.


Minimum requirement of Zones :

Zone needs minimum 50 MB of Disk and 15 MB of memory. Sun recommends 100 MB disk space for a zone as a minimum.  




 Zones states :


• Confiugured :     Configuration was completed and saved
• Incomplete :       Transition state during install or uninstall operation
• Installed :           The packages have been successfully installed
• Ready :              The virtual platform has been installed
• Running :           The zone booted successfully and is now running in normal state
• Shutting down :  The zone is in the process of shutting down.
• Down:                The zone has completed the shut down process and is down

Configuring a Zone:

Before Zone can be installed or booted it has to be created and configured. This section deals with the initials configuration.

Zonecfg command is used to configure zone. Zonecfg carries out the following things:

* Create or delete zone configuration.

* Add or remove resources in configuration

* Set the properties for a resource in the configuration.

*Query and Verify the configuration.

* Save and Commit the configuration

* Revert to previous configuration.

* Exit from Zonecfg session.

Create a Zone named “test-zone”

# zonecfg –z test-zone
#zonecfg:test-zone>create

#zonecfg:test-zone> add fs

#zonecfg:test-zone:fs> set dir=/test-mount

#zonecfg:test-zone:fs> set special=/dev/dsk/c0t0d0s5

#zonecfg:test-zone:fs> set raw=/dev/rdsk/c0t0d0s5

#zonecfg:test-zone:fs> set type=ufs

#zonecfg:test-zone:fs> add options [logging. Nosuid]

#zonecfg:test-zone:fs> end

The directory that is to be loopback mounted from global zone. The following example shows that /opt/test-zone

inherit-pkg-dir

#zonecfg:test-zone:> add inherit-pkg-dir

#zonecfg:test-zone: inherit-pkg-dir > set dir=/opt/test-zone

#zonecfg:test-zone: inherit-pkg-dir > end

Setup of the network interface for the zone. The following code example specifies an IP address 192.168.10.150 and the physical interface to be used in hme0

net address, physical

#zonecfg:test-zone:> add net

#zonecfg:test-zone:net> set physical=hme0

#zonecfg:test-zone:net> set address=192.168.10.150

#zonecfg:test-zone:net>end

A device to be included into zone. The following code example included a tape drive /dev/rmt/0

#zonecfg:test-zone>  add device

#zonecfg:test-zone:device> set match=/dev/rmt/0

#zonecfg:test-zone:device> end

There are two zone-wide resource controls namely zone.cpu-shares and zone max-lwps

Following examples to sets the CPU shares to 20.

rctl , name and value

#zonecfg:test-zone> add rctl

#zonecfg:test-zone:rctl> set name=zone.cpu-shares

#zonecfg:test-zone:rctl> set value=(priv=priviledged,limit=20,action=none)

#zonecfg:test-zone:rctl> end

It used for adding a comment to a zone The following example is used to add comment for  the zone apps

attr 

#zonecfg:test-zone> add attr

#zonecfg:test-zone:attr> set name=comment

#zonecfg:test-zone:attr> set type=string

#zonecfg:test-zone:attr> set value=”The Application Zone”

#zonecfg:test-zone:attr> end

Add memory into Zone, The below subcommands is used to add memory for specific zone.

Capped-memory

#zonecfg:test-zone> add capped-memory

#zonecfg:test-zone:capped-memory> set locked=2g

#zonecfg:test-zone:capped-memory> end

#zonecfg:test-zone>verify
#zonecfg:test-zone>commit

#zonecfg:test-zone>end

Now Zone name “test-zone” has been configured. Before Installing the zone please verify the zone configuration

#zoneadm –z test-zone verify

#zoneadm –z test-zone install

After Installation.

#zoneadm –z test-zone ready

#zoneadm –z test-zone boot

Halting zone

#zoneadm –z test-zone hault

Rebooting zone

#zoneadm –z test-zone reboot

Uninstalling Zone

#zoneadm –z test-zone uninstall –F

And after uninstalled then delete , This command will delete all the zone related files and directory.

#zoneadm –z test-zone delete –F 

||Quick Start ||

Open a terminal and confirm the 3.5 disk space will be free to configure the zone.

Create Zone directory :

#mkdir /zone

Change permission for the directory

#chmod 700 /zone

Create a Zone named “test-zone”

# zonecfg –z test-zone

#zonecfg:test-zone> add fs

#zonecfg:test-zone:fs> set dir=/zone

#zonecfg:test-zone:fs> set special=/dev/dsk/c0t0d0s5

#zonecfg:test-zone:fs> set raw=/dev/rdsk/c0t0d0s5

#zonecfg:test-zone:fs> set auto-boot=true

#zonecfg:test-zone:fs> set type=ufs

#zonecfg:test-zone:fs> add options [logging. Nosuid]

#zonecfg:test-zone:fs> end

#zonecfg:test-zone:> add inherit-pkg-dir

#zonecfg:test-zone: inherit-pkg-dir > set dir=/opt/test-zone

#zonecfg:test-zone: inherit-pkg-dir > end

#zonecfg:test-zone:> add net

#zonecfg:test-zone:net> set physical=hme0

#zonecfg:test-zone:net> set address=192.168.10.150

#zonecfg:test-zone:net> end

#zonecfg:test-zone>  add device

#zonecfg:test-zone:device> set match=/dev/rmt/0

#zonecfg:test-zone:device> end

#zonecfg:test-zone> add rctl

#zonecfg:test-zone:rctl> set name=zone.cpu-shares

#zonecfg:test-zone:rctl> set value=(priv=priviledged,limit=20,action=none)

#zonecfg:test-zone:rctl> end

#zonecfg:test-zone> add attr

#zonecfg:test-zone:attr> set name=comment

#zonecfg:test-zone:attr> set type=string

#zonecfg:test-zone:attr> set value=”The Application Zone”

#zonecfg:test-zone:attr> end

#zonecfg:test-zone> add capped-memory

#zonecfg:test-zone:capped-memory> set locked=2g

#zonecfg:test-zone:capped-memory> end

#zonecfg:test-zone> commit

#zonecfg:test-zone> verify

#zonecfg:test-zone> end

Now Zone name “test-zone” has been configured. Before Installing the zone please verify the zone configuration

#zoneadm –z test-zone verify

#zoneadm –z test-zone install

After Installation.

#zoneadm –z test-zone ready

#zoneadm –z test-zone boot

#zlogin –z test-zone