Manual Pages for UNIX Operating System command usage for man zones

Standards, Environments, and Macros                      zones(5)



NAME
     zones - Solaris application containers

DESCRIPTION
     The zones facility in Solaris provides an isolated  environ-
     ment  for  running applications. Processes running in a zone
     are prevented from  monitoring  or  interfering  with  other
     activity  in  the system. Access to other processes, network
     interfaces, file systems, devices, and inter-process commun-
     ication  facilities  are  restricted  to prevent interaction
     between processes in different zones.


     The privileges available within a  zone  are  restricted  to
     prevent    operations    with    system-wide   impact.   See
     privileges(5).


     You can configure and administer zones with the  zoneadm(1M)
     and zonecfg(1M) utilities. You can specify the configuration
     details a  zone,  install  file  system  contents  including
     software  packages  into  the  zone,  and manage the runtime
     state of the zone. You can use the zlogin(1) to run commands
     within  an  active  zone. You can do this without logging in
     through a network-based login server such as  in.rlogind(1M)
     or sshd(1M).


     The autobooting of zones is  enabled  and  disabled  by  the
     zones service, identified by the FMRI:


     svc:/system/zones:default


     See zoneadm(1M). Note that a zone has an autoboot  property,
     which  can be set to true (always autoboot). However, if the
     zones service is disabled, autoboot will not occur,  regard-
     less  of  the  setting  of the autoboot property for a given
     zone. See zonecfg(1M).


     An alphanumeric name and numeric  ID  identify  each  active
     zone.   Alphanumeric   names   are   configured   using  the
     zonecfg(1M) utility. Numeric IDs are automatically  assigned
     when the zone is booted. The zonename(1) utility reports the
     current zone name, and the zoneadm(1M) utility can  be  used
     to report the names and IDs of configured zones.


     A zone can be in one of several states:




SunOS 5.11          Last change: 29 Jan 2009                    1






Standards, Environments, and Macros                      zones(5)



     CONFIGURED       Indicates that the  configuration  for  the
                      zone has been completely specified and com-
                      mitted to stable storage.


     INCOMPLETE       Indicates that the zone is in the midst  of
                      being  installed  or  uninstalled,  or  was
                      interrupted in the midst of such a  transi-
                      tion.


     INSTALLED        Indicates that the zone's configuration has
                      been  instantiated  on the system: packages
                      have been installed under the  zone's  root
                      path.


     READY            Indicates that the "virtual  platform"  for
                      the   zone   has   been   established.  For
                      instance, file systems have  been  mounted,
                      devices   have   been  configured,  but  no
                      processes associated  with  the  zone  have
                      been started.


     RUNNING          Indicates that  user  processes  associated
                      with  the  zone application environment are
                      running.


     SHUTTING_DOWN    Indicates that the zone  is  being  halted.
     DOWN             The  zone  can become stuck in one of these
                      states if it is unable  to  tear  down  the
                      application   environment  state  (such  as
                      mounted file systems) or if some portion of
                      the  virtual  platform cannot be destroyed.
                      Such cases require operator intervention.


  Process Access Restrictions
     Processes running inside a zone (aside from the global zone)
     have restricted access to other processes. Only processes in
     the same zone are visible  through  /proc  (see  proc(4)  or
     through system call interfaces that take process IDs such as
     kill(2) and priocntl(2). Attempts to access  processes  that
     exist  in  other zones (including the global zone) fail with
     the same error code that would be issued  if  the  specified
     process did not exist.

  Privilege Restrictions
     Processes running within a non-global zone are restricted to
     a  subset  of  privileges, in order to prevent one zone from



SunOS 5.11          Last change: 29 Jan 2009                    2






Standards, Environments, and Macros                      zones(5)



     being able to perform operations  that  might  affect  other
     zones.  The  set  of  privileges  limits the capabilities of
     privileged users (such  as  the  super-user  or  root  user)
     within  the  zone. The list of privileges available within a
     zone can be displayed using the ppriv(1) utility.  For  more
     information about privileges, see privileges(5).

  Device Restrictions
     The set of devices available within a zone is restricted, to
     prevent   a  process  in  one  zone  from  interfering  with
     processes in other zones. For example, a process in  a  zone
     should  not be able to modify kernel memory using /dev/kmem,
     or modify the contents of the root disk. Thus,  by  default,
     only  a  few pseudo devices considered safe for use within a
     zone are available. Additional devices can be made available
     within specific zones using the zonecfg(1M) utility.


     The device and  privilege  restrictions  have  a  number  of
     effects  on the utilities that can run in a non-global zone.
     For example, the eeprom(1M),  prtdiag(1M),  and  prtconf(1M)
     utilities  do  not work in a zone since they rely on devices
     that are not normally available.

  Brands
     A zone may be assigned a brand when it is initially created.
     A  branded  zone  is  one whose software does not match that
     software found in the global zone. The software may  include
     Solaris  software  configured or laid out differently, or it
     may include non-Solaris software. The particular  collection
     of  software  is  called  a  "brand"  (see  brands(5)). Once
     installed, a zone's brand may not be changed unless the zone
     is first uninstalled.

  File Systems
     Each zone has its own section of the file system  hierarchy,
     rooted  at  a  directory  known  as the zone root. Processes
     inside the zone can access only files within  that  part  of
     the  hierarchy,  that is, files that are located beneath the
     zone root. This prevents processes in one zone from corrupt-
     ing  or  examining  file system data associated with another
     zone. The chroot(1M) utility can be used within a zone,  but
     can  only  restrict  the  process  to a root path accessible
     within the zone.


     In order to preserve file system space, sections of the file
     system  can  be  mounted  into  one  or more zones using the
     read-only option of the lofs(7FS) file system.  This  allows
     the  same  file  system data to be shared in multiple zones,
     while preserving the security guarantees supplied by zones.




SunOS 5.11          Last change: 29 Jan 2009                    3






Standards, Environments, and Macros                      zones(5)



     NFS and autofs mounts established within a zone are local to
     that zone; they cannot be accessed from other zones, includ-
     ing the global zone. The mounts are removed when the zone is
     halted or rebooted.

  Networking
     A zone has its own port number space for TCP, UDP, and  SCTP
     applications and typically one or more separate IP addresses
     (but some configurations  of  Trusted  Extensions  share  IP
     address(es) between zones).


     For the IP layer (IP routing, ARP, IPsec, IP Filter, and  so
     on) a zone can either share the configuration and state with
     the global zone (a shared-IP zone), or have its distinct  IP
     layer configuration and state (an exclusive-IP zone).


     If a zone is to be connected to the same datalink, that  is,
     be on the same IP subnet or subnets as the global zone, then
     it is  appropriate  for  the  zone  to  use  the  shared  IP
     instance.


     If a zone needs to be isolated at the IP layer on  the  net-
     work,  for  instance  being  connected to different VLANs or
     different LANs than the global  zone  and  other  non-global
     zones,  then  for isolation reasons the zone should have its
     exclusive IP.


     A shared-IP zone is  prevented  from  doing  certain  things
     towards  the  network  (such  as  changing its IP address or
     sending spoofed IP or Ethernet packets), but an exclusive-IP
     zone has more or less the same capabilities towards the net-
     work as a separate host that is connected to the  same  net-
     work  interface. In particular, the superuser in such a zone
     can change its IP address and spoof ARP packets.


     The shared-IP zones are assigned one or more network  inter-
     face  names  and  IP  addresses  in zonecfg(1M). The network
     interface name(s) must also  be  configured  in  the  global
     zone.


     The exclusive-IP zones are  assigned  one  or  more  network
     interface  names in zonecfg(1M). The network interface names
     must be exclusively assigned to that zone, that is,  it  (or
     they)  can  not  be assigned to some other running zone, nor
     can they be used by the global zone.




SunOS 5.11          Last change: 29 Jan 2009                    4






Standards, Environments, and Macros                      zones(5)



     The full IP-level functionality in the form of DHCP  client,
     IPsec  and IP Filter, is available in exclusive-IP zones and
     not in shared-IP zones.

  Host Identifiers
     A zone is capable of emulating  a  32-bit  host  identifier,
     which  can be configured via zonecfg(1M), for the purpose of
     system consolidation. If a zone emulates a host  identifier,
     then  commands such as hostid(1) and sysdef(1M) as well as C
     interfaces such as sysinfo(2)  and  gethostid(3C)  that  are
     executed  within  the  context  of  the zone will display or
     return the zone's emulated host identifier rather  than  the
     host machine's identifier.

ATTRIBUTES
     See attributes(5) for descriptions of the  following  attri-
     butes:



     ____________________________________________________________
    |       ATTRIBUTE TYPE        |       ATTRIBUTE VALUE       |
    |_____________________________|_____________________________|
    | Availability                | SUNWcs                      |
    |_____________________________|_____________________________|


SEE ALSO
     hostid(1), zlogin(1), zonename(1), in.rlogind(1M), sshd(1M),
     sysdef(1M),  zoneadm(1M), zonecfg(1M), kill(2), priocntl(2),
     sysinfo(2),  gethostid(3C),  getzoneid(3C),   ucred_get(3C),
     proc(4),     attributes(5),     brands(5),    privileges(5),
     crgetzoneid(9F)






















SunOS 5.11          Last change: 29 Jan 2009                    5