$ makezone.ksh
- Even after running makezone.ksh to create and install a zone, it is not fully done yet. For example, it will not install rsa/dsa public keys for ssh, hostname, interface, authentication, name service, root passwd etc.
- To fix this issue from the global zone, zlogin to zone's console with "zlogin -C zonename". It will prompt you for a few things to configure.
(We need to automate it by creating a sysidcfg file and putting it in /root/etc of jumpstart. Need to review sun doc on this)
Zone commands:
zoneadm list -cv #listing zoneszoneadm -z zonename halt #halt a running zone
#Delete a zone:zoneadm -z zonename uninstall #uninstall to configured mode zonecfg -z zonename delete #completely delete a zone
#Standard:
- As a standard, we must have two machines located in different sites that will run the backup virtual machines. Without a backup virutual machine, we won't allow using containers.
- Each machine must have multipath enabled.
- We decided to use full zone/container instead of sparse for the ease of patching containers independently. However, the kernel will be still shared across containers with the global zone.
- Monitoring viritual servers could generate duplicate messages for the same hardware since they are shared with global zone and other containers. We need to plan a bit if we could use global zone do the hardware monitoring, we can monitor only the application on the containers.
- Backups needs to be done on each container level for ease of restore
- Multipath at the global zone is transparent to the containers. The virtual machines binding to one of the interfaces knows how to failover to the second interface that is part of the multipath group in the global zone.
# Mounting a file system to a non-global zone:
1). For readonly types use loopback (lofs) as follows:
# zonecfg -z zoneabc
zonecfg:zoneabc> add fs
zonecfg:zoneabc:fs> set dir=/opt/abc
zonecfg:zoneabc:fs> set special=/opt/abc
zonecfg:zoneabc:fs> set type=lofs
zonecfg:zoneabc:fs> add options ro
zonecfg:zoneabc:fs> end
zonecfg:zoneabc> commit zonecfg:zoneabc> exit
2) For rw and dedicated file system:
root@tbespclapp-g1
# zonecfg -z zoneabczonecfg:zoneabc> add fs
zonecfg:zoneabc:fs> set dir=/opt
zonecfg:zoneabc:fs> set special=/dev/dsk/c1t0d0s0
zonecfg:zoneabc:fs> set raw=/dev/vx/rdsk/c1t0d0s0
zonecfg:zoneabc:fs> set type=ufs zonecfg:zoneabc:fs> end
zonecfg:zoneabc> commit
zonecfg:zoneabc> exit
3)For NFS via /etc/vfstab or automounter
# You need to either mounht the filesystem from global zone or reboot the non-global zone:
# mount /dev/dsk/c1t3d0s7 /zones/zoneabc/root/opt/enidata
Once a file system is assigned, it should show up as follows:
root@unixdevzone1
# zonecfg -z unixdeveni1
zonecfg:unixdeveni1> infozonename: unixdeveni1
zonepath: /zones/unixdeveni1
brand: native
autoboot: true
bootargs:
pool:
limitpriv:
scheduling-class:
ip-type: shared
fs:
dir: /opt/enidata
special: /dev/dsk/c1t3d0s7
raw: /dev/rdsk/c1t3d0s7
type: ufs
options: []
net:
address: 165.237.139.58
physical: nxge0
defrouter: 165.237.139.126
device
match: /dev/rdsk/c1t3d0s7
device
match: /dev/dsk/c1t3d0s7
dedicated-cpu:
ncpus: 4-16
importance: 1
capped-memory:
physical: 16G
[swap: 8G]
[locked: 12G]
rctl:
name: zone.max-swap
value: (priv=privileged,limit=8589934592,action=deny)
rctl:
name: zone.max-locked-memory
value: (priv=privileged,limit=12884901888,action=deny)
zonecfg:unixdeveni1>
# Changing dedicated cpu resources for a zone.
- On the globalzone, run:
#zonecfg -z zonenamezonecfg:unixdeveni1> select
dedicated-cpu
zonecfg:unixdeveni1:dedicated-cpu> info
dedicated-cpu:
ncpus: 4-16
importance: 1
zonecfg:unixdeveni1:
dedicated-cpu> set ncpus=24-32
zonecfg:unixdeveni1:dedicated-cpu> infodedicated-cpu: ncpus: 24-32 importance: 1
zonecfg:unixdeveni1:dedicated-cpu> end
zonecfg:unixdeveni1>
zonecfg:unixdeveni1> verify
zonecfg:unixdeveni1> commit
zonecfg:unixdeveni1> exit
# You can do the same for capped-memory resource.
# Enable snoop on a non-global zone:
# zonecfg -z testzonecfg:test> set limitpriv=default,net_rawaccess zonecfg:test> exit
- reboot the zone- login and run the command as root# ppriv $$4547: -shflags = E: basic,contract_event,contract_observer,file_chown,file_chown_self,file_dac_execute, file_dac_read,file_dac_search,file_dac_write,file_owner,file_setid,ipc_dac_read, ipc_dac_write,ipc_owner,net_bindmlp,net_icmpaccess,net_mac_aware,net_privaddr,
- On the global zone, check the network device to get the major and minor devices e.g. 96, 1 in this example:
# ls -l /dev/nge0lrwxrwxrwx 1 root root 38 Apr 21 10:02 /dev/nge0 -> ../devices/pci@0,0/pci108e,5347@a:nge0# ls -l /devices/pci@0,0/pci108e,5347@a:nge0crw-rw-rw- 1 root root 96, 1 Apr 22 10:46 /devices/pci@0,0/pci108e,5347@a:nge0
With this information, we can now create the network device in the non-global zone:
# zonecfg -z test info zonepathzonepath: /my/zones/test# cd /my/zones/test/dev# mknod nge0 c 96 1# ls -l nge0crw-r--r-- 1 root root 96, 1 Apr 25 13:00 nge0
