Sun Microsystems 10 User Manuals

Table of Contents

• 1. Introduction

  1
• 2. Functionality

  2
• 2.1. Solaris Containers and Solaris Zones

  2
• 2.1.1. Overview

  2
• 2.1.2. Zones and software installation

  4
• 2.1.3. Zones and security

  4
• 2.1.4. Zones and privileges

  4
• 2.1.5. Zones and resource management

  5
• 2.1.5.1. CPU resources

  5
• 2.1.5.2. Memory resource management

  6
• 2.1.5.3. Network resource management (IPQoS = IP Quality of Service)

  6
• 2.1.6. User interfaces for zones

  6
• 2.1.7. Zones and high availability

  7
• 2.1.8. Branded zones (Linux and Solaris 8/Solaris 9 compatibility)

  7
• 2.1.9. Solaris container cluster (aka "zone cluster")

  8
• 2.2. Virtualization technologies compared

  9
• 2.2.1. Domains/physical partitions

  10
• 2.2.2. Logical partitions

  11
• 2.2.3. Containers (Solaris zones) in an OS

  12
• 2.2.4. Consolidation in one computer

  13
• 2.2.5. Summary of virtualization technologies

  14
• 3. Use Cases

  16
• 3.1. Grid computing with isolation

  16
• 3.2. Small web servers

  17
• 3.3. Multi-network consolidation

  18
• 3.4. Multi-network monitoring

  19
• 3.5. Multi-network backup

  20
• 3.6. Consolidation development/test/integration/production

  21
• 3.7. Consolidation of test systems

  22
• 3.8. Training systems

  23
• 3.9. Server consolidation

  24
• 3.10. Confidentiality of data and processes

  25
• 3.11. Test systems for developers

  26
• 3.12. Solaris 8 and Solaris 9 containers for development

  27
• 3.13. Solaris 8 and Solaris 9 containers as revision systems

  28
• 3.14. Hosting for several companies on one computer

  29
• 3.15. SAP portals in Solaris containers

  30
• 3.16. Upgrade- and Patch-management in a virtual environment

  31
• 3.17. "Flying zones" – Service-oriented Solaris server infrastructure

  32
• 3.18. Solaris Container Cluster (aka "zone cluster")

  33
• 4. Best Practices

  34
• 4.1. Concepts

  34
• 4.1.1. Sparse-root zones

  34
• 4.1.2. Whole-root zones

  34
• 4.1.3. Comparison between sparse-root zones and whole-root zones

  35
• 4.1.4. Software in zones

  35
• 4.1.5. Software installations in Solaris and zones

  36
• 4.1.5.1. Software installation by the global zone – usage in all zones

  36
• 4.1.5.2. Software installation by the global zone – usage in a local zone

  36
• 4.1.5.3. Software installation by the global zone – usage in the global zone

  37
• 4.1.5.4. Installation by the local zone – usage in the local zone

  37
• 4.1.6. Storage concepts

  38
• 4.1.6.1. Storage for the root file system of the local zones

  38
• 4.1.6.2. Data storage

  38
• 4.1.6.3. Program/application storage

  38
• 4.1.6.4. Root disk layout

  39
• 4.1.6.5. ZFS within a zone

  39
• 4.1.6.6. Options for using ZFS in local zones

  40
• 4.1.6.7. NFS and local zones

  40
• 4.1.6.8. Volume manager in local zones

  40
• 4.1.7. Network concepts

  41
• 4.1.7.1. Introduction into networks and zones

  41
• 4.1.7.2. Network address management for zones

  41
• 4.1.7.3. Shared IP instance and routing between zones

  41
• 4.1.7.4. Exclusive IP instance

  42
• 4.1.7.5. Firewalls between zones (IP filter)

  42
• 4.1.7.6. Zones and limitations in the network

  43
• 4.1.8. Additional devices in zones

  44
• 4.1.8.1. Configuration of devices

  44
• 4.1.8.2. Static configuration of devices

  44
• 4.1.8.3. Dynamic configuration of devices

  44
• 4.1.9. Separate name services in zones

  45
• 4.1.9.1. hosts database

  45
• 4.1.9.2. User database (passwd, shadow, user_attr)

  45
• 4.1.9.3. Services

  45
• 4.1.9.4. Projects

  45
• 4.2. Paradigms

  46
• 4.2.1. Delegation of admin privileges to the application department

  46
• 4.2.2. Applications in local zones only

  46
• 4.2.3. One application per zone

  47
• 4.2.4. Clustered containers

  47
• 4.2.5. Solaris Container Cluster

  49
• 4.3. Configuration and administration

  50
• 4.3.1. Manual configuration of zones with zonecfg

  50
• 4.3.2. Manual installation of zones with zoneadm

  50
• 4.3.3. Manual uninstallation of zones with zoneadm

  50
• 4.3.4. Manual removal of a configured zone with zonecfg

  50
• 4.3.5. Duplication of an installed zone

  50
• 4.3.6. Standardized creation of zones

  50
• 4.3.7. Automatic configuration of zones by script

  51
• 4.3.8. Automated provisioning of services

  51
• 4.3.9. Installation and administration of a branded zone

  51
• 4.4. Lifecycle management

  52
• 4.4.1. Patching a system with local zones

  52
• 4.4.2. Patching with live upgrade

  52
• 4.4.3. Patching with upgrade server

  53
• 4.4.4. Patching with zoneadm attach -u

  53
• 4.4.5. Moving zones between architectures (sun4u/sun4v)

  53
• 4.4.6. Re-installation and service provisioning instead of patching

  54
• 4.4.7. Backup and recovery of zones

  54
• 4.4.8. Backup of zones with ZFS

  55
• 4.4.9. Migration of a zone to another system

  55
• 4.4.10. Moving a zone within a system

  55
• 4.5. Management and monitoring

  55
• 4.5.1. Using boot arguments in zones

  55
• 4.5.2. Consolidating log information of zones

  56
• 4.5.3. Monitoring zone workload

  56
• 4.5.4. Extended accounting with zones

  56
• 4.5.5. Auditing operations in the zone

  56
• 4.5.6. DTrace of processes within a zone

  57
• 4.6. Resource management

  58
• 4.6.1. Types of resource management

  58
• 4.6.2. CPU resources

  58
• 4.6.2.1. Capping of CPU time for a zone

  58
• 4.6.2.2. General resource pools

  58
• 4.6.2.3. Fair share scheduler (FSS)

  59
• 4.6.2.4. Fair share scheduler in a zone

  59
• 4.6.2.5. Dynamic resource pools

  59
• 4.6.2.6. Lightweight processes (LWP)

  59
• 4.6.3. Limiting memory resources

  60
• 4.6.3.1. Assessing memory requirements for global and local zones

  60
• 4.6.3.2. Limiting virtual memory

  60
• 4.6.3.3. Limiting a zone's physical memory requirement

  60
• 4.6.3.4. Limiting locked memory

  61
• 4.6.4. Network limitation (IPQoS)

  61
• 4.6.5. IPC limits (Semaphore, shared memory, message queues)

  61
• 4.6.6. Privileges and resource management

  61
• 4.7. Solaris container navigator

  62
• 5. Cookbooks

  65
• 5.1. Installation and configuration

  65
• 5.1.1. Configuration files

  65
• 5.1.2. Special commands for zones

  66
• 5.1.3. Root disk layout

  68
• 5.1.4. Configuring a sparse root zone: required Actions

  69
• 5.1.5. Configuring a whole root zone: required Actions

  70
• 5.1.6. Zone installation

  71
• 5.1.7. Zone initialization with sysidcfg

  71
• 5.1.8. Uninstalling a zone

  72
• 5.1.9. Configuration and installation of a Linux branded zone with CentOS

  72
• 5.1.10. Configuration and installation of a Solaris 8/Solaris 9 container

  73
• 5.1.11. Optional settings

  73
• 5.1.11.1. Starting zones automatically

  73
• 5.1.11.2. Changing the set of privileges of a zone

  73
• 5.1.12. Storage within a zone

  74
• 5.1.12.1. Using a device in a local zone

  74
• 5.1.12.2. The global zone supplies a file system per lofs to the local zone

  74
• 5.1.12.3. The global zone mounts a file system when the local zone is booted

  75
• 5.1.12.4. The local zone mounts a UFS file system from a device

  75
• 5.1.12.5. User level NFS server in a local zone

  76
• 5.1.12.6. Using a DVD drive in the local zone

  76
• 5.1.12.7. Dynamic configuration of devices

  76
• 5.1.12.8. Several zones share a file system

  78
• 5.1.12.9. ZFS in a zone

  78
• 5.1.12.10. User attributes for ZFS within a zone

  78
• 5.1.13. Configuring a zone by command file or template

  79
• 5.1.14. Automatic quick installation of zones

  79
• 5.1.15. Accelerated automatic creation of zones on a ZFS file system

  80
• 5.1.16. Zones hardening

  80
• 5.2. Network

  81
• 5.2.1. Change network configuration for shared IP instances

  81
• 5.2.2. Set default router for shared IP instance

  81
• 5.2.3. Network interfaces for exclusive IP instances

  81
• 5.2.4. Change network configuration from shared IP instance to exclusive IP instance

  82
• 5.2.5. IP filter between shared IP zones on a system

  82
• 5.2.6. IP filter between exclusive IP zones on a system

  83
• 5.2.7. Zones, networks and routing

  83
• 5.2.7.1. Global and local zone with shared network

  83
• 5.2.7.2. Zones in separate network segments using the shared IP instance

  84
• 5.2.7.3. Zones in separate network segments using exclusive IP instances

  85
• 5.2.7.4. Zones in separate networks using the shared IP instance

  86
• 5.2.7.5. Zones in separate networks using exclusive IP instances

  87
• 5.2.7.6. Zones connected to independent customer networks using the shared IP instance

  88
• 5.2.7.7. Zones connected to independent customer networks using exclusive IP instances

  90
• 5.2.7.8. Connection of zones via external routers using the shared IP instance

  91
• 5.2.7.9. Connection of zones through an external load balancing router using exclusive IP instances

  93
• 5.3. Lifecycle management

  95
• 5.3.1. Booting a zone

  95
• 5.3.2. Boot arguments in zones

  95
• 5.3.3. Software installation per mount

  96
• 5.3.4. Software installation with provisioning system

  97
• 5.3.5. Zone migration among systems

  97
• 5.3.6. Zone migration within a system

  98
• 5.3.7. Duplicating zones with zoneadm clone

  99
• 5.3.8. Duplicating zones with zoneadm detach/attach and zfs clone

  101
• 5.3.9. Moving a zone between a sun4u and a sun4v system

  102
• 5.3.10. Shutting down a zone

  104
• 5.3.11. Using live upgrade to patch a system with local zones

  104
• 5.4. Management and monitoring

  106
• 5.4.1. DTrace in a local zone

  106
• 5.4.2. Zone accounting

  106
• 5.4.3. Zone audit

  106
• 5.5. Resource management

  107
• 5.5.1. Limiting the /tmp-size within a zone

  107
• 5.5.2. Limiting the CPU usage of a zone (CPU capping)

  107
• 5.5.3. Resource pools with processor sets

  107
• 5.5.4. Fair share scheduler

  108
• 5.5.5. Static CPU resource management between zones

  108
• 5.5.6. Dynamic CPU resource management between zones

  108
• 5.5.7. Static CPU resource management in a zone

  108
• 5.5.8. Dynamic CPU resource management in a zone

  108
• 5.5.9. Dynamic resource pools for zones

  109
• 5.5.10. Limiting the physical main memory consumption of a project

  110
• 5.5.11. Implementing memory resource management for zones

  110
• Supplement

  112
• A. Solaris Container in OpenSolaris

  112
• A.1. OpenSolaris – general

  112
• A.1. ipkg-Branded zones

  112
• A.1. Cookbook: Configuring an ipkg zone

  113
• A.2. Cookbook: Installing an ipkg zone

  113
• B. References

  114