Oracle Solaris 11 is a complete, integrated, and open platform
engineered for large-scale enterprise environments. Its built-in Oracle
Solaris Native Zones technology provides application virtualization
through isolated, encapsulated, and highly secure environments that run
on top of a single, common kernel. As a result, native zones provide a
highly efficient, scalable, zero-overhead virtualization solution that
sits at the core of the platform.
With the inclusion of the
Kernel Zones feature, Oracle Solaris 11.2 provides a flexible,
cost-efficient, cloud-ready solution that is perfect for the data
center.
This article describes how to create a kernel zone in
Oracle Solaris 11.2, as well as how to configure the kernel zone to your
requirements, install it, and boot it.
You will learn about the
two main methods of installing a kernel zone: direct installation and
installation via an ISO image. In addition, you will learn about a third
installation method that enables you to convert a native zone to a
kernel zone. You will learn how to update a kernel zone so that it uses a
different Oracle Solaris release than the release that is running in
the host machine's kernel.
The examples in this article will
leave you familiar with the basic procedures for installing,
configuring, and managing kernel zones in Oracle Solaris 11.2.
Note:
This article demonstrates how to update a kernel zone from Oracle
Solaris 11.2 to a later release through examples that mention "Oracle
Solaris 11.3" and "Oracle Solaris Next." These examples are purely
hypothetical and are for demonstration purposes only; no release later
than Oracle Solaris 11.2 is currently available.
About Oracle Solaris Zones and Kernel Zones
Oracle Solaris
Zones let you isolate one application from others on the same operating
system (OS), allowing you to create a user-, security-, and
resource-controlled environment suitable to that particular application.
Each Oracle Solaris Zone can contain a complete environment and also
allows you to control different resources such as CPU, memory,
networking, and storage.
The system administrator who owns the
host system can choose to closely manage all the Oracle Solaris Zones on
the system. Alternatively, the system administrator can assign rights
to other system administrators for specific Oracle Solaris Zones. This
flexibility lets you tailor an entire computing environment to the needs
of a particular application.
Kernel zones, the newest type of
Oracle Solaris Zones, provide all the flexibility, scalability, and
efficiency of Oracle Solaris Zones while adding the capability to have
zones with independent kernels. This capability is highly useful when
you are trying to coordinate the updating of multiple zone environments
belonging to different owners.
With kernel zones, the updates can
be done at the level of an individual kernel zone at a time that is
convenient for each owner. In addition, applications that have specific
version requirements can run side by side on the same system and benefit
from the high consolidation ratios that Oracle Solaris Zones provide.
Benefits of the Each Installation Method
In this article, we will create three kernel zones using different methods:
- The first method will show how quickly and easily you can create a new kernel zone using a direct installation—that is, an installation based on the OS running on the host system. This is an extremely useful method for getting additional kernel zone environments up and running quickly in response to a new application or user demands.
- Using the second method, you will learn how to create a kernel zone from an ISO image. This is useful when it is desirable to deploy a specific kernel version to support an application or environment.
- Using the final method, you will learn how to convert a native zone to a kernel zone. This is useful when you want to update an application or service to run on a later kernel version without affecting the other services running on the system.
Figure 1 summarizes what we will do:
Figure 1. Illustration of the three methods for creating kernel zones
Prerequisites
There
are a couple of tasks that need to be completed before we create our
first kernel zone. We need to check that the hardware is capable of
running kernel zones, and we also need to provide a hint to the system
about application memory usage.
Checking the Hardware Capabilities
Kernel zones will run only on certain types of hardware, as follows:
- Intel CPUs with CPU virtualization (VT-x) enabled in BIOS and with support for Extended Page Tables (EPT), such as Nehalem or newer CPUs
- AMD CPUs with CPU virtualization (AMD-v) enabled in BIOS and with support for Nested Page Tables (NPT), such as Barcelona or newer CPUs
- sun4v CPUs with a "wide" partition register, for example, Oracle's SPARC T4 or SPARC T5 processors running a supported firmware version and Oracle's SPARC M5, SPARC M6, or newer processors
You can easily check that the system is capable of running kernel zones by using the
virtinfo command, as shown in Listing 1:root@global:~# virtinfoNAME CLASSnon-global-zone supportedkernel-zone supported
Listing 1
You can see from the output in Listing 1 that kernel zones are supported.
There are some other hardware prerequisites; for a full list, see the Oracle Solaris Kernel Zones documentation.
Providing Information About Application Memory Usage
When
using kernel zones, is it necessary to provide a hint to the system
about application memory usage. This information is used to limit the
growth of the ZFS Adaptive Replacement Cache (ARC) so that more memory
stays available for applications and, in this case, for the kernel zones
themselves.
Providing this hint is achieved by setting the
user_reserve_hint_pct parameter. A script is provided for doing this, and the current recommendation is to set the value to 80.root@global:~# ./set_user_reserve.sh -f 80Adjusting user_reserve_hint_pct from 0 to 80Adjustment of user_reserve_hint_pct to 80 successful.
You can find this script and more information by visiting the My Oracle Support website and then accessing Doc ID 1663862.1.
Creating Your First Kernel Zone Using the Direct Installation Method
For a full discussion on all the steps involved in creating a kernel zone and configuring all its attributes, please see Creating and Using Oracle Solaris Kernel Zones.
This article will concentrate on a subset of the steps to demonstrate
how to quickly get a kernel zone instance up and running.
Prerequisites
First, check the status of the ZFS file system and the network, as shown in Listing 2:
demo@global:~$ zfs list | grep zonesrpool/VARSHARE/zones 16.5G 348G 32K /system/zonesdemo@global:~$ dladm show-linkLINK CLASS MTU STATE OVERnet1 phys 1500 unknown --net0 phys 1500 up --net2 phys 1500 unknown --net3 phys 1500 unknown --
Listing 2
Note: In
Listing 2, there are no ZFS datasets associated with any specific zones.
We will see later how these are created for you as you install zones.
Also note that there are no virtual network interface card (VNIC)
devices.
Let's also check the Oracle Solaris version of the
global zone, as shown in Listing 3, because we will use this information
later:
root@global:~# uname -aSunOS global 5.11 11.2 i86pc i386 i86pc
Listing 3
In Listing 3, we can see the version is Oracle Solaris 11.2.
Note: In this article, we will use
uname as a quick way of showing the kernel version of the system. However, that is not the recommended way to check the system version. The recommended way is to query the entire package, as shown in Listing 4, which also indicates that the version is Oracle
Solaris 11.2. (See "Understanding Oracle Solaris 11 Package Versioning" for an explanation about how to decipher the output when you query the entire package.)
demo@dcsw-79-168:~$ pkg list entireNAME (PUBLISHER) VERSION IFOentire 0.5.11-0.175.2.0.0.41.0 i—
Listing 4
We can also see that the system has a publisher set up:
root@global:~# pkg publisherPUBLISHER TYPE STATUS P LOCATIONsolaris origin online F http://ipkg.us.oracle.com/solaris11/dev/
Step 1: Create the Kernel Zone
Let's start by creating our first kernel zone using the command line, as shown in Listing 5:
root@global:~# zonecfg -z myfirstkz create -t SYSsolaris-kz
Listing 5
In Listing 5, note that all we need to supply is the zone name (
myfirstkz) and the kernel zone brand (SYSsolaris-kz).
By default, all Oracle Solaris Zones are configured to have an automatic VNIC called
anet,
which gives us a network device automatically. We cannot see this
network device, but it is automatically created upon booting the zone
(and also automatically destroyed upon shutdown). We can check this by
using the dladm command:root@global:~# dladm show-linkLINK CLASS MTU STATE OVERnet1 phys 1500 unknown --net0 phys 1500 up --net2 phys 1500 unknown --net3 phys 1500 unknown --
We can also see that, as of yet, no storage has been created for our kernel zone:
root@global:~# zfs list | grep zonesrpool/VARSHARE/zones 16.5G 348G 32K /system/zones
We can verify that the kernel zone is now in the configured state by using the
zoneadm command:root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared- myfirstkz configured - solaris-kz excl
Let's take a look at the default settings for the kernel zone that we have created. We can do this by passing the
info option to the zonecfg command, as shown in Listing 6:root@global~# zonecfg -z myfirstkz infozonename: myfirstkzbrand: solaris-kzautoshutdown: shutdownautoboot: false bootargs: pool:hostid: 0x3888f5a3scheduling-class: tenant: anet:allowed-address not specifiedlower-link: autodefrouter not specifiedconfigure-allowed-address: truelink-protection: mac-nospoofallowed-dhcp-cids not specified mac-address: autovlan-id not specifiedmac-prefix not specified mac-slot not specified priority not specifiedmaxbw not specifiedrxrings not specified txrings not specified mtu not specified rxfanout not specifiedetsbw-lcl not specifiedvsi-typeid not specified vsi-vers not specified vsi-mgrid not specified cos not specified evs not specifiedid: 0vport not specified id: 0 device: match not specified storage: dev:/dev/zvol/dsk/rpool/VARSHARE/zones/myfirstkz/disk0 bootpri: 0physical: 2Gcapped-memory:
Listing 6
From the output in Listing 6, we can see that the zone is called
myfirstkz, that it is a kernel zone (brand: solaris-kz), that we have a boot disk (and its location is dev:/dev/zvol/dsk/rpool/VARSHARE/zones/myfirstkz/disk0) and, finally, that we have 2 GB of physical memory assigned to this kernel zone.
What
we don't see is the amount of CPU resources we have for this kernel
zone. When nothing is specified, the default is to have one virtual CPU
assigned. We'll see how to verify this later when we boot the kernel
zone.
Step 2: Install the Kernel Zone
Now that the kernel zone has been created, we need to install it.
For this first installation, we are going to use what is called a direct installation.
With a direct installation, the installer runs on the host. It will
create and format the kernel zone's boot disk and install Oracle Solaris
packages on that disk, using the host's package publishers. Since the
installer is running on the host, the installer can install only the
exact version of Oracle Solaris that it is actively running on the host.
This
installation method makes use of the Oracle Solaris 11 Image Packaging
System. You will need to make sure you have access to your Image
Packaging System repository; in this case, we have network access to our
repository. For more details on the Image Packaging System, see "Introducing the Basics of Image Packaging System (IPS) on Oracle Solaris 11."
Run the following command to install the
myfirstkz kernel zone:root@global:~# zoneadm -z myfirstkz installProgress being logged to /var/log/zones/zoneadm.20140724T124406Z.myfirstkz.installpkg cache: Using /var/pkg/publisher.AI Manifest: /tmp/zoneadm6814.Voa43n/devel-ai-manifest.xmlInstall Log: /system/volatile/install.7395/install_logCreating IPS imageSC Profile: /usr/share/auto_install/sc_profiles/enable_sci.xml Installation: Starting ...The following licenses have been accepted and not displayed.Installing packages from: solaris origin: http://ipkg.us.oracle.com/solaris11/dev/consolidation/osnet/osnet-incorporationPlease review the licenses for the following packages post-install: Package licenses may be viewed using the command:pkg info --license
We can check on the status of the
myfirstkz kernel zone using the zoneadm command:root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared- myfirstkz installed - solaris-kz excl
Note: A kernel zone needs a boot disk
on which it is installed; by using the command shown in Listing 7, we
can see that this boot disk has been created for us:
root@global:~# zfs list | grep zonesrpool/VARSHARE/zones 16.5G 348G 32K /system/zonesrpool/VARSHARE/zones/myfirstkz 16.5G 348G 31K /system/zones/myfirstkzrpool/VARSHARE/zones/myfirstkz/disk0 16.5G 361G 2.92G -
Listing 7
You can see in Listing 7 that the
/myfirstkz/disk0 dataset has been created automatically for you.Step 3: Boot the Kernel Zone and Complete the System Configuration
The final step in getting
myfirstkz
up and running is to boot it and set up the system configuration. We
will boot the zone and then access its console using one command at the
command line, as shown in Listing 8, so the majority of the console
output can be seen:root@global:~# zoneadm -z myfirstkz boot; zlogin -C myfirstkz[Connected to zone 'myfirstkz' console]Boot device: disk0 File and args:reading module /platform/i86pc/amd64/boot_archive...done.reading kernel file /platform/i86pc/kernel/amd64/unix...done.Copyright (c) 1983, 2014, Oracle and/or its affiliates. All rights reserved.SunOS Release 5.11 Version 11.2 64-bit Loading smf(5) service descriptions: 183/183Configuring devices.
Listing 8
Note: The
-C option to zlogin shown in Listing 8 lets us access the zone console; the command will bring us into the zone and let us work within the zone.
Because no system configuration files are available, the System Configuration Tool starts up, as shown in Figure 2.
Figure 2. Initial screen of the System Configuration Tool
Press F2 to continue.
In the System Identity screen (shown in Figure 3), enter
myfirstkz as the computer name, and then
press F2 to continue.
Figure 3. System Identity screen
In the
Network screen (shown in Figure 4), Enter the network settings
appropriate for your network and then press F2. Here we will select Automatically.
Figure 4. Network screen
In the Time Zone:
Regions screen (shown in Figure 5), choose the time zone region
appropriate for your location. In this example, we chose Europe. Then press F2.
Figure 5. Time Zone: Regions screen
In the
Time Zone: Locations screen (shown in Figure 6), choose the time zone
location appropriate for your location, and then press F2.
Figure 6. Time Zone: Locations screen
In the Time Zone screen (shown in Figure 7), choose the time zone appropriate for your location, and then press F2.
Figure 7. Time Zone screen
In the Locale: Language screen (shown in Figure 8), choose the language appropriate for your location, and then press F2.
Figure 8. Locale: Language screen
In the
Locale: Territory screen (shown in Figure 9), choose the language
territory appropriate for your location, and then press F2.
Figure 9. Locale: Territory screen
In the Date and Time screen (shown in Figure 10), set the date and time, and then press F2.
Figure 10. Date and Time screen
In the Keyboard screen (shown in Figure 11), select the appropriate keyboard, and then press F2.
Figure 11. Keyboard screen
In the Users screen (shown in Figure 12), choose a root password and enter information for a user account. Then press F2.
Figure 12. Users screen
In the Support — Registration screen (shown in Figure 13), enter your My Oracle Support credentials. Then press F2.
Figure 13. Support — Registration screen
In
the Support — Network Configuration screen (shown in Figure 14), choose
how you will send configuration data to Oracle. Then press F2.
Figure 14. Support — Network Configuration screen
In
the System Configuration Summary screen (shown in Figure 15), verify
that the configuration you have chosen is correct and apply the settings
by pressing F2.
Figure 15. System Configuration Summary screen
The zone will continue booting, and soon you will see the console login:
SC profile successfully generated as:/etc/svc/profile/sysconfig/sysconfig-20140724-130314/sc_profile.xmlExiting System Configuration Tool. Log is available at:myfirstkz console login:/system/volatile/sysconfig/sysconfig.log.287 Hostname: myfirstkz
The zone is now ready to be logged in to. For this example, we will now exit the console using the "
~." escape sequence.
You can check that your zone is booted and running using the
zoneadm command:root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared2 myfirstkz running - solaris-kz excl
As promised, a VNIC was automatically created for us when the zone was booted. We can verify this by using the
dladm command shown in Listing 9:root@global:~# dladm show-linkLINK CLASS MTU STATE OVERnet1 phys 1500 unknown --net0 phys 1500 up --net2 phys 1500 unknown -- net3 phys 1500 unknown --myfirstkz/net0 vnic 1500 up net0
Listing 9
In Listing 9, we can see the VNIC is listed as
myfirstkz/net0.Step 4: Log In to Your Kernel Zone
The last step is to log in to your zone and have a look. You can do this from the global zone using the
zlogin command, as shown in Listing 10:root@global:~# zlogin myfirstkz[Connected to zone 'myfirstkz' pts/1]Oracle Corporation SunOS 5.11 11.2 June 2014root@myfirstkz:~# uname -aSunOS myfirstkz 5.11 11.2 i86pc i386 i86pc
root@myfirstkz:~# ipadm show-addrADDROBJ TYPE STATE ADDRlo0/v4 static ok 127.0.0.1/8net0/v4 dhcp ok 10.134.79.210/24lo0/v6 static ok ::1/128net0/v6 addrconf ok fe80::8:20ff:fe47:ca30/10
root@myfirstkz:~# dladm show-linkLINK CLASS MTU STATE OVERnet0 phys 1500 up --
root@myfirstkz:~# zfs listNAME USED AVAIL REFER MOUNTPOINTrpool 4.65G 10.7G 32.5K /rpoolrpool/ROOT/solaris-5 2.58G 10.7G 2.08G /rpool/ROOT 2.58G 10.7G 31K legacy rpool/ROOT/solaris-5/var 510M 10.7G 508M /varrpool/VARSHARE/pkg 63K 10.7G 32K /var/share/pkgrpool/VARSHARE 2.52M 10.7G 2.43M /var/share rpool/VARSHARE/pkg/repositories 31K 10.7G 31K /var/share/pkg/repositoriesrpool/export 96.5K 10.7G 32K /exportrpool/VARSHARE/zones 31K 10.7G 31K /system/zones rpool/dump 1.03G 10.8G 1.00G - rpool/export/home 64.5K 10.7G 32K /export/homerpool/swap 1.03G 10.8G 1.00G -rpool/export/home/demo 32.5K 10.7G 32.5K /export/home/demo
root@myfirstkz:~# zonenameglobal
root@myfirstkz:~# exitlogout[Connection to zone 'myfirstkz' pts/1 closed]
Listing 10
Note: In Listing 10, we did not use the
-C option for the zlogin
command, which means we are not accessing the zone via its console.
This is why we can simply exit the shell at the end to leave the zone.
Let's look at the output shown in Listing 10 to see what we have:
- The output of the
unamecommand shows that we are running on Oracle Solaris 11.2—the same kernel version used in the global zone in which ourmyfirstkzkernel zone is running. - The output of the
ipadmcommand shows the IP address formyfirstkz. There are four entries: two loopback devices (IPv4 and IPv6), our IPv4net0device with an IP address of10.134.79.210and, finally, an IPv6net0device. - The output of the
dladmcommand shows our automatically creatednet0VNIC. - The output of the
zfs listcommand shows our ZFS dataset. - Finally, the output of the
zonenamecommand shows that our zone name isglobal. With native zones, this would be the actual zone name. However, a kernel zone actually runs a full kernel instance, so users running inside the kernel zone have their own instance of a global zone.
If you want to determine the zone name from inside the kernel zone, you can use the
virtinfo command:root@global:~# zlogin myfirstkz[Connected to zone 'myfirstkz' pts/1]Oracle Corporation SunOS 5.11 11.2 June 2014
root@myfirstkz:~# virtinfo -c current get zonenameNAME CLASS PROPERTY VALUEkernel-zone current zonename myfirstkzroot@myfirstkz:~# exitlogout
Note: From within
myfirstkz, we cannot see any information about the global zone; we can see only the attributes of our own zone.
You have now verified that
myfirstkz
is up and running. You can give the login information to your users to
allow them to complete the setup of their team's kernel zone as if it
were a single system.Updating a Kernel Zone to a Later Oracle Solaris Release
One
of the main features of kernel zones is the ability to run your kernel
zone with a different kernel version from that of the host global zone.
Starting
with Oracle Solaris 11.2, kernel zones support both backwards and
forwards compatibility. What that means in practice is that you can not
only have a kernel zone running Oracle Solaris 11.2 on a host running a
later Oracle Solaris version, say Oracle Solaris 11.3 (when it is
available), but you can also have a kernel zone running a later Oracle
Solaris version, say Oracle Solaris 11.3, on a host running Oracle
Solaris 11.2. Figure 16 illustrates this capability.
Figure 16. Example of forward and backward compatibility of kernel zones
Updating myfirstkz to a Later Oracle Solaris Release
Let's
update our kernel zone to use a later Oracle Solaris release—a
hypothetical "Oracle Solaris Next" release—rather than the release
running on the host (Oracle Solaris 11.2).
First, let's use the command shown in Listing 11 to look at what boot environments we have from the host global zone:
root@global:~# beadm listBE Active Mountpoint Space Policy Created-- ------ ---------- ----- ------ -------solaris-1 - - 47.78M static 2014-06-25 08:12solaris - - 44.67M static 2012-01-26 18:59 solaris-2 - - 46.71M static 2014-06-25 08:40solaris-4 NR / 52.77G static 2014-07-20 18:41solaris-3 - - 1.03G static 2014-06-25 23:30 solaris-3-backup-1 - - 221.0K static 2014-07-10 14:23solaris-backup-1 - - 144.0K static 2012-01-26 19:28
Listing 11
In Listing 11, we could
see a list of native zone boot environments, if there were any. However,
we will not see kernel zone boot environments listed, because a kernel
zone has its own boot disk.
Let's check what our current
publisher is and point the kernel zone to a publisher that has a newer
kernel. We start by logging in to
myfirstkz, as shown in Listing 12:root@global:~# zlogin myfirstkz[Connected to zone 'myfirstkz' pts/2]Oracle Corporation SunOS 5.11 11.2 June 2014
root@myfirstkz:~# pkg publisherPUBLISHER TYPE STATUS P LOCATIONsolaris origin online F http://ipkg.us.oracle.com/solaris11/dev/
root@myfirstkz:~# pkg set-publisher -G '*' -g http://ipkg.us.oracle.com/solaris-n/dev/ solaris
root@myfirstkz:~# pkg publisherPUBLISHER TYPE STATUS P LOCATIONsolaris origin online F http://ipkg.us.oracle.com/solaris-n/dev/
Listing 12
Note that in this example,
we will use an internally created repository. You will be able to
reproduce this for yourself as later releases of Oracle Solaris become
available. In Listing 12, we can see that we are running Oracle Solaris
11.2, and we have set our publisher to point to the
dev repository.
Before we update, let's look at what the kernel zone sees as its boot environment:
root@myfirstkz:~# beadm listBE Active Mountpoint Space Policy Created-- ------ ---------- ----- ------ -------solaris-5 NR / 7.91M static 2014-07-24 13:44
Now, let's update our kernel zone, as shown in Listing 13:
root@myfirstkz:~# pkg update --accept------------------------------------------------------------Package: pkg://solaris/consolidation/osnet/osnet-incorporation@5.12,5.12-5.12.0.0.0.52.0:20140714T022826Z License: lic_OTNis subject to (i) the license terms that you accepted when you obtainedYou acknowledge that your use of this Oracle Solaris software productyou agreed to when you placed your Oracle Solaris software order withthe right to use Oracle Solaris software; or (ii) the license terms thatare not applicable, then, (iv) the OTN License Agreement for OracleOracle; or (iii) the Oracle Solaris software license terms included with the hardware that you acquired from Oracle; or, if (i), (ii) or (iii)http://www.oracle.com/technetwork/licenses/solaris-cluster-express-license-Solaris (which you acknowledge you have read and agree to) available at 167852.html. Note: Software downloaded for trial use or downloaded as replacement media may not be used to update any unsupported software.Create backup boot environment: NoPackages to remove: 37 Packages to install: 57 Packages to update: 432 Mediators to change: 4 Create boot environment: YesRemoving old actions 6580/6580DOWNLOAD PKGS FILES XFER (MB) SPEED Completed 526/526 23157/23157 363.4/363.4 16.7M/s PHASE ITEMSUpdating image state DoneInstalling new actions 9594/9594 Updating modified actions 24807/24807 Updating package state database Done Updating package cache 469/469mounted on '/'. Reboot when ready to switch to this updated BE.Creating fast lookup database Done Updating package cache 1/1 A clone of solaris-5 exists and has been updated and activated. On the next boot the Boot Environment solaris-6 will be---------------------------------------------------------------------------Updating package cache 1/1 --------------------------------------------------------------------------- NOTE: Please review release notes posted at:http://www.oracle.com/pls/topic/lookup?ctx=solaris11&id=SERNS
Listing 13
In the command shown in Listing 13, we use the
--accept
option to automatically accept any licenses. We can see in the output
that a boot environment has been created. Let's look at what that is, as
shown in Listing 14:root@myfirstkz:~# beadm listBE Active Mountpoint Space Policy Created-- ------ ---------- ----- ------ -------solaris-6 R - 7.39G static 2014-07-24 17:04solaris-5 N / 7.91M static 2014-07-24 13:44
Listing 14
In Listing 14, we can see from the
R next to the solaris-6 boot environment that after a reboot, we will select this new environment.
Finally, let's reboot the zone.
root@myfirstkz:~# reboot[Connection to zone 'myfirstkz' pts/2 closed]root@global:~#
We are now back in the host global zone, and we can use
zoneadm to check the status of our kernel zone, as shown in Listing 15:root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared3 myfirstkz running - solaris-kz excl
Listing 15
As shown in Listing 15, our kernel zone has already rebooted and is running again.
Let's log back in, as shown in Listing 16, and check what kernel version we are running:
root@global:~# zlogin myfirstkz[Connected to zone 'myfirstkz' pts/2]Oracle Corporation SunOS 5.n sn_52 June 2014
Listing 16
Listing 16 shows we are running a completely different kernel: the hypothetical "Oracle Solaris Next."
Let's run the command shown in Listing 17 to take a final look at the boot environments before we leave this kernel zone:
root@myfirstkz:~# beadm listBE Active Mountpoint Space Policy Created-- ------ ---------- ----- ------ -------solaris-6 NR / 7.50G static 2014-07-24 17:04solaris-5 - - 12.35M static 2014-07-24 13:44root@myfirstkz:~# exitlogout[Connection to zone 'myfirstkz' pts/2 closed]
Listing 17
In Listing 17, we can see that we are running in the new boot environment.
Installing a Kernel Zone from an ISO Image
Sometimes
you might not want to do a direct installation with a kernel zone; you
might want to install from an ISO image instead. This is supported for
kernel zones, and this section will show how to do that.
We will
also use this opportunity to explore how to allocate some dedicated CPU
resources to the kernel zone, as well as how to add some extra memory
and increase the size of its boot disk.
Step 1: Configure Dedicated CPU Resources and More Memory
Let's create a new kernel zone similar to what we did before, but this time we will use the
zonecfg command to add some dedicated CPU resources.
Let's start by checking how many CPU resources we have:
root@global:~# psrinfo -tsocket: 0core: 0cpus: 0,8core: 1 cpus: 1,9cpus: 2,10core: 2 core: 3core: 8cpus: 3,11 socket: 1cpus: 5,13cpus: 4,12 core: 9 core: 10cpus: 7,15cpus: 6,14core: 11
Now, let's create a new kernel zone called
iso-kz and then add four CPU's worth of dedicated CPU resources to it:root@global:~# zonecfg -z iso-kz create -t SYSsolaris-kzroot@global:~# zonecfg -z iso-kzzonecfg:iso-kz> add dedicated-cpuzonecfg:iso-kz:dedicated-cpu> set ncpus=4zonecfg:iso-kz:dedicated-cpu> endzonecfg:iso-kz> verifyzonecfg:iso-kz> commitzonecfg:iso-kz> exit
We can check that the zone creation and resource configuration worked by using the
zonecfg command:root@global:~# zonecfg -z iso-kz info dedicated-cpudedicated-cpu:ncpus: 4cpus not specifiedcores not specifiedsockets not specified
You can set a kernel zone to have either virtual CPUs or dedicated CPUs. The difference between the two types is basically about sharing.
- With a virtual CPU, the CPU resource is shared with the rest of the system or other zones and it can be leveraged in cases where the kernel zone is not busy.
- With dedicated a CPU, the CPU resource is exclusive to the kernel zone and will never be used by anything other than that specific kernel zone.
We can also use the
zonecfg command to add some extra memory to the kernel zone:root@global:~# zonecfg -z iso-kzzonecfg:iso-kz> select capped-memoryzonecfg:iso-kz:capped-memory> set physical=3gzonecfg:iso-kz:capped-memory> endzonecfg:iso-kz> verifyzonecfg:iso-kz> commitzonecfg:iso-kz> exit
root@global:~# zonecfg -z iso-kz info capped-memorycapped-memory:physical: 3G
Step 2: Install the Kernel Zone with a Bigger Disk
It's
now time to install our zone. We will use a hypothetical Oracle Solaris
11.3 ISO image to do this and we will also increase the size of the
install disk. The default is a 16 GB disk, so let's increase that to 24
GB. Listing 18 shows how you do this at installation time:
root@global:~# zoneadm -z iso-kz install -b /root/sol-11_3-42-text-x86.iso -x install-size=24g
Listing 18
In Listing 18, you can see that this time, the image we used is using the text installer.
Once we have answered the usual installation questions, we can log in to our zone, as shown in
Listing 19:
root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared5 iso-kz running - solaris-kz excl3 myfirstkz running - solaris-kz exclroot@global:~# zlogin iso-kz[Connected to zone 'iso-kz' pts/2]Oracle Corporation SunOS 5.11 11.3 June 2014root@:~#root@solarisiso-kz:~# psrinfo -tsocket: 0core: 0cpu: 0core: 1 cpu: 1core: 3core: 2 cpu: 2root@:~# exitcpu: 3logout[Connection to zone 'iso-kz' pts/2 closed]
Listing 19
In Listing 19, we can see
the four dedicated CPUs we assigned and we can see that we are running a
release different than that of the host global zone.
Before we move on, let's shut down our two kernel zones:
root@global:~# zoneadm -z myfirstkz shutdownroot@global:~# zoneadm -z iso-kz shutdown
Converting a Native Zone to a Kernel Zone
The
final operation to try is converting a native zone to a kernel zone,
which is made especially easy through the use of Oracle Solaris Unified
Archives.
In this example, we will use a native zone that has already been created. If you are not sure how to create a native zone, see "How to Get Started Creating Oracle Solaris Zones in Oracle Solaris 11."
Let's start by having a look at the native zone we are going to convert, as shown in Listing 20:
root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared- myfirstkz installed - solaris-kz excl6 native-zone running /system/zones/native-zone solaris excl - iso-kz installed - solaris-kz exclroot@global:~# zlogin native-zone[Connected to zone 'native-zone' pts/2]Oracle Corporation SunOS 5.11 11.2 June 2014root@native-zone:~# touch my_special_filesroot@native-zone:~# zonenamenative-zoneroot@native-zone:~# exitlogout[Connection to zone 'native-zone' pts/2 closed]root@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared- iso-kz installed - solaris-kz excl- myfirstkz installed - solaris-kz excl- native-zone installed /system/zones/native-zone solaris excl
Listing 20
In Listing 20, we can see our native-zone is already up and running, and we have logged in and created a file called
my_special_files.
This example is just to reflect any configuration that we might have
done when taking a zone from a real environment. Finally, we checked the
zone name, logged out, and shut down the native zone.
Note:
One of the big advantages of using a Unified Archive to capture a zone
is that you can do the capture on a running zone, which means you can
avoid outages to end users. In this case, because we want to convert our
native zone to a kernel zone (rather than clone the native zone), we
shut down the native zone.
Now let's create a Unified Archive of our native zone:
root@global:~# archiveadm create -z native-zone ./native-zone-archive.uarInitializing Unified Archive creation resources...Unified Archive initialized: /root/native-zone-archive.uarLogging to: /system/volatile/archive_log.26165Preparing archive system image...Executing dataset discovery... Dataset discovery completeBeginning final archive assembly...Beginning archive stream creation... Archive stream creation completeArchive creation complete
Once we have created the archive, we can examine it to see what it contains:
root@global:~# ls -ltotal 5602777-rw-r--r-- 1 root root 901992448 Jul 1 06:18 0.175.2_ai_i386.iso-rw-r--r-- 1 root root 1308958720 Jul 24 17:27 native-zone-archive.uar-rw-r--r-- 1 demo staff 675102720 Jul 24 07:37 sol-11_2-42-text-x86.isoroot@global:~# archiveadm info -v ./native-zone-archive.uarArchive InformationCreation Time: 2014-07-24T21:54:08ZSource Host: globalOperating System: Oracle Solaris 11.3 X86Architecture: i386 Recovery Archive: NoArchive Version: 1.0Unique ID: e1bf0d42-338b-e879-fec4-ab78290ef55c Deployable Systems 'native-zone'Brand: solarisOS Version: 0.5.11 OS Branch: 0.175.3.0.0.1.0 Active BE: solarisAI Media: 0.175.3_ai_i386.isoSize Needed: 978MB Unique ID: f488ea7c-ab1e-6cc4-d407-c60fce1e3818Root-only: Yes
Next, let's configure a new kernel zone and when we are
ready to install it, we will pass in the archive, as shown in
Listing
21:
root@global:~# zonecfg -z converted-zone-kz create -t SYSsolaris-kzroot@global:~# zoneadm -z converted-zone-kz install -a ./native-zone-archive.uarProgress being logged to /var/log/zones/zoneadm.20140724T233807Z.converted-zone-kz.install[Connected to zone 'converted-zone-kz' console]Boot device: cdrom1 File and args: -B install=true,auto-shutdown=true -B aimanifest=/system/shared/ai.xmlreading module /platform/i86pc/amd64/boot_archive...done. reading kernel file /platform/i86pc/kernel/amd64/unix...done.Probing for device nodes ...SunOS Release 5.11 Version 11.2 64-bit Copyright (c) 1983, 2014, Oracle and/or its affiliates. All rights reserved. Remounting root read/writesolaris console login:Preparing image for use Done mounting image Configuring devices. Hostname: solaris Using specified install manifest : /system/shared/ai.xmlDetailed logging is in the logfile at /system/volatile/install_logAutomated Installation started The progress of the Automated Installation will be output to the console Press RETURN to get a login prompt at any time.23:40:15 Using profile specification: /system/volatile/profile23:40:15 Install Log: /system/volatile/install_log 23:40:15 Using XML Manifest: /system/volatile/ai.xml 23:40:15 Starting installation. 23:40:15 0% Preparing for Installation23:40:19 3% Preparing for Installation23:40:15 100% manifest-parser completed. 23:40:15 100% None 23:40:15 0% Preparing for Installation 23:40:18 1% Preparing for Installation 23:40:18 2% Preparing for Installation23:40:23 Selected Disk(s) : c1d023:40:19 4% Preparing for Installation 23:40:19 5% archive-1 completed. 23:40:21 8% target-discovery completed. 23:40:23 Pre-validating manifest targets before actual target selection23:40:24 10% ai-configuration completed.23:40:24 Pre-validation of manifest targets completed 23:40:24 Validating combined manifest and archive origin targets 23:40:24 Selected Disk(s) : c1d0 23:40:24 9% target-selection completed. 23:40:24 9% var-share-dataset completed.23:40:39 50% Transferring contents23:40:29 10% target-instantiation completed. 23:40:29 10% Beginning archive transfer 23:40:29 Commencing transfer of stream: ce6d4b69-ad85-e7e1-aaf7-fdbfdc17f001-0.zfs to rpool 23:40:35 30% Transferring contents 23:40:43 70% Transferring contents23:41:31 Setting post-install publishers to:23:40:54 86% Transferring contents 23:41:09 Completed transfer of stream: 'ce6d4b69-ad85-e7e1-aaf7-fdbfdc17f001-0.zfs' from file:///system/shared/uafs/OVA 23:41:12 Archive transfer completed 23:41:31 90% generated-transfer-965-1 completed. 23:41:31 90% Beginning IPS transfer23:51:21 Setting boot devices in firmware23:41:31 solaris 23:41:31 origin: http://ipkg.us.oracle.com/solaris11/dev/ 23:41:32 90% generated-transfer-965-2 completed. 23:41:32 Changing target pkg variant. This operation may take a while 23:51:17 90% apply-pkg-variant completed. 23:51:21 91% boot-configuration completed.23:51:37 98% cleanup-archive-install completed.23:51:21 91% update-dump-adm completed. 23:51:21 92% setup-swap completed. 23:51:22 92% device-config completed. 23:51:23 92% apply-sysconfig completed. 23:51:23 93% transfer-zpool-cache completed. 23:51:36 98% boot-archive completed. 23:51:36 98% transfer-ai-files completed. 23:51:38 100% create-snapshot completed.root@global:~# zoneadm list -cv23:51:39 100% None 23:51:39 Automated Installation succeeded. 23:51:39 You may wish to reboot the system at this time. Automated Installation finished successfully Shutdown requested. Shutting down the system Log files will be available in /var/log/install/ after reboot svc.startd: The system is coming down. Please wait.ID NAME STATUS PATH BRAND IP0 global running / solaris shared- iso-kz installed - solaris-kz excl- myfirstkz installed - solaris-kz excl - native-zone installed /system/zones/native-zone solaris excl- converted-zone-kz installed - solaris-kz excl
Listing 21
As we can see in Listing 21, the install process completed successfully and we have an installed kernel zone.
Let's boot up our newly converted zone and have a look at it, as shown in Listing 22:
root@global:~# zoneadm -z converted-zone-kz bootroot@global:~# zoneadm list -cvID NAME STATUS PATH BRAND IP0 global running / solaris shared3 converted-zone-kz running - solaris-kz excl- duckstack unavailable - solaris-kz excl - native-zone installed /system/zones/native-zone solaris exclroot@global:~# zlogin converted-zone-kz[Connected to zone 'converted-zone-kz' pts/1]Oracle Corporation SunOS 5.11 11.2 June 2014root@unknown:~# lsmy_special_files
Listing 22
In Listing 22, we can see that the contents of our native zone have been preserved.
Conclusion
In
this article, we explored how to create, install, boot, and configure a
kernel zone. You learned that Oracle Solaris Kernel Zones have the
ability to run kernel versions that are different from the kernel
version running on the host. We also saw how to do a direct installation
and an installation based on an ISO image. Finally, we saw how to
convert a native zone to a kernel zone using Unified Archives.
No comments: