[zones-discuss] Re: guidance for beginner
Thanks - had a look round the docs - quite a lot of stuff on resource management - but i get the general idea. zonemgr -a add -n m1 -z \/zones\ -P \abc123\ \\ -I \192.168.0.10|hme0|24|myzonehost\ I want to do this for 4 zones per box - dont think I need to deal with resource mangement plenty available. Intend to use sysidcfg for config. I am not clear on what the non-root zones will inherit - there is already a single application installed on each box (in a separete slice) - on this occasion I dont want this included in the non-root zones. I think that by default (ie above) only Solaris will be copied over (?). How does the size of the non-root zone's slices get specified BTW. I only need 5 GB in total for each user - (oh dear that sounds a bit like resource management ;-) TIA Tony This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org
[zones-discuss] A Virtual Router/Switch for Virtual Machines?
I apologize if this has been discussed, as I am relatively new to this forum. I would like to create a network of containers under a single global zone. Can I do this without hitting the physical network? I envision the ability to create virtual routers and switches, allowing one to create this network of Solaris and Linux zones within a single physical box. (This would provide a huge benefit to a transaction processing shop.) Just a thought... This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] A Virtual Router/Switch for Virtual Machines?
Bill Quayle wrote: I apologize if this has been discussed, as I am relatively new to this forum. I would like to create a network of containers under a single global zone. Can I do this without hitting the physical network? I envision the ability to create virtual routers and switches, allowing one to create this network of Solaris and Linux zones within a single physical box. (This would provide a huge benefit to a transaction processing shop.) Multiple containers can communicate with each other, without using the physical network for inter-container transport. All inter-container traffic stays in the IP stack. Another example is a web server which sits in one container and uses the physical network, and an app server which only communicates with the web server, and perhaps with another container in which you run a DB server. But if you would like something more sophisticated, e.g. packets come in from the network into one container where they are filtered, and some packets are forwarded/routed to other containers in the same system, you should be looking at Crossbow - http://opensolaris.org/os/project/crossbow/ . -- Jeff VICTOR Sun Microsystemsjeff.victor @ sun.com OS AmbassadorSr. Technical Specialist Solaris 10 Zones FAQ:http://www.opensolaris.org/os/community/zones/faq -- ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] SSH disconnections during zone creation
Manish, Wee Yeh is correct. The zonemgr doesn't do anything that would cause your ssh to the global zone to disconnect. I test with ssh sessions to my global zone all the time and never encounter that problem. Brad On Tue, 2007-01-30 at 11:25 +0800, Wee Yeh Tan wrote: Manish, I have not used zonemgr but I am quite sure this is not due to zonemgr specifically. If you are accessing the global zone through a firewall, it is possible that the firewall is dropping your connection due to inactivity. You can try to play around with 'ClientAliveInterval' and 'ClientAliveCountMax' sshd parameters to have sshd send some data that keeps the session alive. ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] Re: guidance for beginner
Hello Tony, The usage that you specified below will place your zone root in /zones/m1. At this point in time there is no storage containment management within zonemgr for the non-global root mount point. (e.g. /zones/m1) If you wish to limit the storage of that mount point to 5GB then you will need to do that in the global zone. Also note that at the present time Solaris does not support non-global zone root being put on a ZFS filesystem. Thus /zones/m1 should be some other filesystem type such as UFS. With regards to directory inheritance, zonemgr by default creates a sparse root zone. This means that the default system directories (/lib, /usr, /sbin, and /platform) are inherited from the global zone. With regards to packaging, for both sparse and whole root (e.g. no directories inherited) the non-global zone will contain all packages that are present in the global zone. If the application to which you refer is installed in the global zone via pkgadd, then the application bits will also be installed in each non-global zone. Data and configuration of the application in the global zone however will not be installed/copied into the non-global zone. Hope that helps! Brad On Mon, 2007-02-05 at 03:37 -0800, [EMAIL PROTECTED] wrote: Thanks - had a look round the docs - quite a lot of stuff on resource management - but i get the general idea. zonemgr -a add -n m1 -z \/zones\ -P \abc123\ \\ -I \192.168.0.10|hme0|24|myzonehost\ I want to do this for 4 zones per box - dont think I need to deal with resource mangement plenty available. Intend to use sysidcfg for config. I am not clear on what the non-root zones will inherit - there is already a single application installed on each box (in a separete slice) - on this occasion I dont want this included in the non-root zones. I think that by default (ie above) only Solaris will be copied over (?). How does the size of the non-root zone's slices get specified BTW. I only need 5 GB in total for each user - (oh dear that sounds a bit like resource management ;-) TIA Tony This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org
[zones-discuss] Re: SSH disconnections during zone creation
Sorry for the delay in getting back. The problem is indeed in ssh (http://www.ssh.com/). I followed the suggestion to use PuTTy and set the keepalive parameter to 15 seconds. Now I am able to create zones without problem. Thanks Manish This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] Re: unable to migrate zone
Do we know when its going to be in Solaris 10? maybe U4 or patch? Any time frame? Thanks so much for info. Chris On Mon, 5 Feb 2007, Menno Lageman wrote: Gerard Henry wrote: Try 'zoneadm -z servimp2 attach -n /zones/servimp2'. If you get a arning add '-F' after 'attach'. very strange: t2000-root% zoneadm -z servimp2 attach -n /zones/servimp2 -n: illegal option -- n usage: attach [-F] Attach the zone to the system. The zone state must be 'configured' prior to attach; upon successful completion, the zone state will be 'installed'. The system software on the current system must be compatible with the software on the zone's original system. Specify -F to force the attach and skip software compatibility tests. t2000-root% cat /etc/releaseSolaris 10 11/06 s10s_u3wos_10 SPARC Copyright 2006 Sun Microsystems, Inc. All Rights Reserved. Use is subject to license terms. Assembled 14 November 2006 -n is only valid in Solaris Express? Correct, attach -n is only available in Solaris Express and not in Solaris 10 U3 (unfortunately). Menno ___ zones-discuss mailing list zones-discuss@opensolaris.org !DSPAM:122,45c6e6ea22257185627164! ___ zones-discuss mailing list zones-discuss@opensolaris.org
[zones-discuss] question about zones
hello, I just got into zones and I have few questions: is there any way to create zone with some additional customizations? here is what I did: # zonecfg -z titan1 titan1: No such zone configured Use 'create' to begin configuring a new zone. zonecfg:titan1 create zonecfg:titan1 set zonepath=/zones/titan1 zonecfg:titan1 set autoboot=true zonecfg:titan1 add net zonecfg:titan1:net set address=192.168.1.82 zonecfg:titan1:net set physical=bge0 zonecfg:titan1:net end zonecfg:titan1 info zonecfg:titan1 verify zonecfg:titan1 commit zonecfg:titan1 exit Ok, so that created my zone. Now I have to login and changethe following: passwd file to point to new root home directory: /root/ add users. change syslog.conf settings make appriopriate changes in /etc/hosts file. make changes to /etc/mail/sendmail.cf is there any way to automate it? I did create only 10 zones and its not to crazy to login to each of them and do all those different config changes etc, but I was wondering if there was any easier way of doing all of them at the creation time by scripts. I did setup scripts to do most of the stuff with zone creation, to allocate resources per zones, and to zreate zfs for each zone with all the settings that I needed but I was wondering if I can automate it even more. Thanks for any help or pointers that you could give to me... Chris ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] question about zones
Hi Krzys,
Krzys wrote On 02/05/07 12:39,:
hello, I just got into zones and I have few questions:
is there any way to create zone with some additional customizations?
here is what I did:
# zonecfg -z titan1
titan1: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:titan1 create
zonecfg:titan1 set zonepath=/zones/titan1
zonecfg:titan1 set autoboot=true
zonecfg:titan1 add net
zonecfg:titan1:net set address=192.168.1.82
zonecfg:titan1:net set physical=bge0
zonecfg:titan1:net end
zonecfg:titan1 info
zonecfg:titan1 verify
zonecfg:titan1 commit
zonecfg:titan1 exit
Ok, so that created my zone. Now I have to login and changethe following:
passwd file to point to new root home directory: /root/
add users.
change syslog.conf settings
make appriopriate changes in /etc/hosts file.
make changes to /etc/mail/sendmail.cf
is there any way to automate it? I did create only 10 zones and its not
to crazy to login to each of them and do all those different config
changes etc, but I was wondering if there was any easier way of doing
all of them at the creation time by scripts. I did setup scripts to do
most of the stuff with zone creation, to allocate resources per zones,
and to zreate zfs for each zone with all the settings that I needed but
I was wondering if I can automate it even more.
Cloning in 11/06 and NV copies over a lot of things, including SMF repository, from what I
experienced. Your /etc/inet/hosts file will probably still be unique and need to be customized after
install/clone, and possibly before first boot. I have a script that does a lot of the sysidcfg
stuff, in addition to the sysidcfg file.
# cat zoneXcreate.sh
#!/bin/sh
. ./zoneXlocal.include
while [ $I -le $M ]
do
echo $I \c
HOST=`expr ${HOSTBASE} + ${I}`
# Configure the zone
sed -e s%X%${HOST}%g zoneX${ZONETYPE}.cfg | \
sed -e s%ZONEPATH%${ZONEROOT}%g /tmp/zone${HOST}
zonecfg -z zone${HOST} -f /tmp/zone${HOST}
rm /tmp/zone${HOST}
# Install the zone from a master, if it exists
S=`zoneadm -z ${ZONEMASTER} list /dev/null 21`
if [ $? -eq 0 ]
then
zoneadm -z zone${HOST} clone ${ZONEMASTER}
else
zoneadm -z zone${HOST} install
fi
# Set configuration information prior to initial boot
sed -e s/X/${HOST}/g zoneX.sysidcfg
$ZONEROOT/zone${HOST}/root/etc/sysidcfg
echo ${NETBASE}.${HOST}/${NETMASKSIZE} \
${ZONEROOT}/zone${HOST}/root/etc/hostname.vnic${HOST}
echo \n${NETBASE}.${HOST} zone${HOST}
${ZONEROOT}/zone${HOST}/root/etc/hosts
echo \n${NETBASE}.0 ${NETMASK} ${ZONEROOT}/zone${HOST}/root/etc/netmasks
echo $DEFROUTER ${ZONEROOT}/zone${HOST}/root/etc/defaultrouter
echo zone${HOST} ${ZONEROOT}/zone${HOST}/root/etc/nodename
zoneadm -z zone${HOST} boot
I=`expr $I + 1`
done
echo
# cat zoneXlocal.include
### To be customized per host
M=4 ; I=1
NETBASE=10.1.14
NETMASK=255.255.255.192
NETMASKSIZE=26
HOSTBASE=150
INTERFACE=e1000g2
MAC=0:3:ba:d8:50
DEFROUTER=10.1.14.129
ZONEROOT=/export/zones
ZONEMASTER=zoneX
ZONETYPE=exclusive
#ZONETYPE=shared
Steffen
reply-to set to: zones-discuss@opensolaris.org
Thanks for any help or pointers that you could give to me...
Chris
___
zones-discuss mailing list
zones-discuss@opensolaris.org
___
zones-discuss mailing list
zones-discuss@opensolaris.org
[zones-discuss] DNS configuration problem in zonemgr
I am trying to use the -D -d options in zonemgr to configure DNS during zone creation. My command is: zonemgr -a add -n $zonename -z /export/home/zones \ -P $rootpassword -R /root|/usr/bin/bash \ -I $ipaddress|elxl0|25|$zonename \ -s basic|lock -S ssh \ -D ismlab.usf.edu -d 131.247.16.129 131.247.16.130 131.247.100.1 \ -C /etc/ssh/sshd_config The variables in the script above are: $zonename:torresd $ipaddress:131.247.16.173 $rootpassword:4220Ism I am getting the following error: Error: The default route doesn't match the subnet of the zone IP address. This may cause the zone to hang on reboot if the zone cannot connect to the DNS server. To resolve this you may need to login to the console with zlogin -C torresd and complete the DNS configuration in the console. I then have to configure DNS manually in the zone. Relevant information is provided below: -bash-3.00# cat /etc/defaultrouter 131.247.16.254 -bash-3.00# netstat -r Routing Table: IPv4 Destination Gateway Flags Ref Use Interface - - -- - 131.247.16.128 unknown U 1 1239 elxl0 BASE-ADDRESS.MCAST.NET unknown U 1 0 elxl0 default vlan272.edu-msfc.net.usf.edu UG1 6904 elxl0 localhostlocalhostUH71049585 lo0 Routing Table: IPv6 Destination/MaskGateway Flags Ref Use If --- --- - --- -- - fe80::/10 fe80::2c0:4fff:fe60:d4b9U 1 0 elxl0 ff00::/8fe80::2c0:4fff:fe60:d4b9U 1 0 elxl0 default fe80::2c0:4fff:fe60:d4b9U 1 0 elxl0 localhost localhost UH 10359 lo0 The network configuration in the global zone is fine: -bash-3.00# traceroute www.sun.com traceroute to www.sun.com (72.5.124.61), 30 hops max, 40 byte packets 1 vlan272.edu-msfc.net.usf.edu (131.247.16.254) 0.783 ms 0.631 ms 0.509 ms 2 wan-msfc.net.usf.edu (131.247.254.40) 0.625 ms 0.633 ms 0.734 ms 3 g2-1.core01.tpa01.atlas.cogentco.com (38.101.48.173) 1.025 ms 1.063 ms 1.018 ms -bash-3.00# ping www.gm.com www.gm.com is alive The entire output during zone creation is: -bash-3.00# learnscripts.sh 4220trial.info :torresd: :131.247.16.173: :4220IsmSp0793: Error: The default route doesn't match the subnet of the zone IP address. This may cause the zone to hang on reboot if the zone cannot connect to the DNS server. To resolve this you may need to login to the console with zlogin -C torresd and complete the DNS configuration in the console. Preparing to install zone torresd. Creating list of files to copy from the global zone. Copying 15282 files to the zone. Initializing zone product registry. Determining zone package initialization order. Preparing to initialize 955 packages on the zone. Initialized 955 packages on zone. Zone torresd is initialized. Installation of these packages generated warnings: SUNWwgetu CSWcyrusimapd The file /export/home/zones/torresd/root/var/sadm/system/logs/install_log contains a log of the zone installation. Creating the sysidcfg file for automated zone configuration. Booting zone for the first time. Waiting for first boot tasks to complete. First boot tasks do not complete even though the zone is up and running: -bash-3.00# zonemgr -a list ID NAME STATUS PATH 0 global running/ 29 torresd running/export/home/zones/torresd After logging into the zone (zlogin -C torresd) and initializing DNS information, the above script completes, with the following output: Updating netmask information. Updating /etc/inet/hosts of the global zone with the torresd IP information. Zone torresd is ready. Setting the root user's home directory to /root Setting the root user's shell to /usr/bin/bash Error: Invalid hardening argument for basic method. Use -h flag to see proper usage or -l flag to see the license. ./learnscripts.sh: line 27: -C: command not found I don't believe there is any problem in the defaultroute, because adding the zone information in the script above (domain name, DNS servers) works: Hostname: torresd torresd console login: root Password: Feb 5 13:24:50 torresd login: ROOT LOGIN /dev/console Sun Microsystems Inc. SunOS 5.10 Generic January 2005 -bash-3.00# ping www.gm.com www.gm.com is alive -bash-3.00# ifconfig -a lo0:1: flags=2001000849UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL mtu 8232 index 1 inet 127.0.0.1 netmask ff00 elxl0:1: flags=1000843UP,BROADCAST,RUNNING,MULTICAST,IPv4 mtu 1500 index 2 inet 131.247.16.173 netmask ff80 broadcast 131.247.16.255 Help would be appreciated so that I can create one zone per student with operational dns
Re: [zones-discuss] question about zones
Krzys wrote: hello, I just got into zones and I have few questions: is there any way to create zone with some additional customizations? here is what I did: # zonecfg -z titan1 titan1: No such zone configured Use 'create' to begin configuring a new zone. zonecfg:titan1 create zonecfg:titan1 set zonepath=/zones/titan1 zonecfg:titan1 set autoboot=true zonecfg:titan1 add net zonecfg:titan1:net set address=192.168.1.82 zonecfg:titan1:net set physical=bge0 zonecfg:titan1:net end zonecfg:titan1 info zonecfg:titan1 verify zonecfg:titan1 commit zonecfg:titan1 exit Ok, so that created my zone. Now I have to login and changethe following: passwd file to point to new root home directory: /root/ add users. change syslog.conf settings make appriopriate changes in /etc/hosts file. make changes to /etc/mail/sendmail.cf Because the global zone has access to the files under zonepath, a script can be run in the global zone which manipulates files in the non-global zone. For example, titan1 has a file called /etc/inet/hosts. The same file can be accessed from the global zone with a different name: /zones/titan1/root/etc/inet/hosts. One precaution: after a zone has been booted for the first time, do not trust the contents of its files. A sufficiently-privileged user of a non-global zone may, accidentally or deceptively, modify a file in the non-global zone. is there any way to automate it? I did create only 10 zones and its not to crazy to login to each of them and do all those different config changes etc, but I was wondering if there was any easier way of doing all of them at the creation time by scripts. I did setup scripts to do most of the stuff with zone creation, to allocate resources per zones, and to zreate zfs for each zone with all the settings that I needed but I was wondering if I can automate it even more. Thanks for any help or pointers that you could give to me... Chris ___ zones-discuss mailing list zones-discuss@opensolaris.org -- -- Jeff VICTOR Sun Microsystemsjeff.victor @ sun.com OS AmbassadorSr. Technical Specialist Solaris 10 Zones FAQ:http://www.opensolaris.org/os/community/zones/faq -- ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] Re: guidance for beginner
John's point is correct. I was focusing exclusively on the zone mount point because it has a unique limitation. As John points out you can add a zfs filesystem to the non-global zone and apply limitations to that filesystem. In fact, you can add a legacy mode zfs file system through zonemgr. You can also ro/rw mount any file system that you have created in the global zone with the -r dir and -w dir parameters of zonemgr as well. Enjoy! Brad On Mon, 2007-02-05 at 07:52 -0800, John Clingan wrote: However, generally speaking, zfs datasets can be configured for a zone from the global zone. Example: The global zone admin can create a 5GB dataset and assign it to a zone. The zone administrator can then create and mount filesystems, each with its own quota, from that ZFS dataset. Assign each user their one ZFS-based filesystem. This is an easy and lightweight thing to do in ZFS. Brad Diggs wrote: Hello Tony, The usage that you specified below will place your zone root in /zones/m1. At this point in time there is no storage containment management within zonemgr for the non-global root mount point. (e.g. /zones/m1) If you wish to limit the storage of that mount point to 5GB then you will need to do that in the global zone. Also note that at the present time Solaris does not support non-global zone root being put on a ZFS filesystem. Thus /zones/m1 should be some other filesystem type such as UFS. With regards to directory inheritance, zonemgr by default creates a sparse root zone. This means that the default system directories (/lib, /usr, /sbin, and /platform) are inherited from the global zone. With regards to packaging, for both sparse and whole root (e.g. no directories inherited) the non-global zone will contain all packages that are present in the global zone. If the application to which you refer is installed in the global zone via pkgadd, then the application bits will also be installed in each non-global zone. Data and configuration of the application in the global zone however will not be installed/copied into the non-global zone. Hope that helps! Brad On Mon, 2007-02-05 at 03:37 -0800, [EMAIL PROTECTED] wrote: Thanks - had a look round the docs - quite a lot of stuff on resource management - but i get the general idea. zonemgr -a add -n m1 -z \/zones\ -P \abc123\ \\ -I \192.168.0.10|hme0|24|myzonehost\ I want to do this for 4 zones per box - dont think I need to deal with resource mangement plenty available. Intend to use sysidcfg for config. I am not clear on what the non-root zones will inherit - there is already a single application installed on each box (in a separete slice) - on this occasion I dont want this included in the non-root zones. I think that by default (ie above) only Solaris will be copied over (?). How does the size of the non-root zone's slices get specified BTW. I only need 5 GB in total for each user - (oh dear that sounds a bit like resource management ;-) TIA Tony This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org
[zones-discuss] Changing a zone's inherit-pkg-dir
Hi. We have a zone currently setup on one of our Solaris 10 servers, but it wasn't configured quite properly. Is there a way to go back and add an inherited dir to a zone that's already configured and has been running for a couple of weeks? Thanks This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org
[zones-discuss] Capped memory observability
I just got a chance to start playing with the capped memory resource controls in build 56. At first blush, this looks to be *very* good stuff. My initial testing included some very basic single process memory hog tests and multiple process mmap(..., MAP_SHARED,...) tests. In each case, the limits kicked in as I expected, and prstat -Z running from the global zone gave what appeared to be accurate information. Great job! One of the effects of setting capped-memory resource control for swap is that the size of /tmp is also limited. Unlike when a tmpfs size limit is set with the size=... mount option, df /tmp does not display a value that is reflective of the limits that are put in place. Similarly, vmstat and swap -l running inside the zone give no indication that there is a cap smaller than the system-wide limits. Am I missing something here? I do see that some of the values I am looking for are available through kstat (thank you!). Is there some more user-friendly tool (already or coming) to use inside the zone? Oh, and the question that everyone at work will ask when I tell them about this - when will it find its way into Solaris? :) Mike -- Mike Gerdts http://mgerdts.blogspot.com/ ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] Changing a zone's inherit-pkg-dir
To my knowledge, the inherit-pkg-dir resource cannot be changed after the zone has been installed. If you want to use binaries placed in those dirs, you may want to use the fs resource of zonecfg. Say absolute-path is the dir you wanted to inherit. zonecfg -z zone zonecfg add fs zonecfg:fs set dir=absolute-path zonecfg:fs set special=absolute-path zonecfg:fs set type=lofs zonecfg:fs end and reboot the zone. You can use absolute-path from within the non global zone now. thanks - Amol Matt Cohen wrote: Hi. We have a zone currently setup on one of our Solaris 10 servers, but it wasn't configured quite properly. Is there a way to go back and add an inherited dir to a zone that's already configured and has been running for a couple of weeks? Thanks This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org -- -- Amol Chiplunkar Sun Microsystems ___ zones-discuss mailing list zones-discuss@opensolaris.org
