blob: 8badc27d3b8e210499506f1566ae685a45da4081 [file] [log] [blame]
'\" te
.\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.\"
.\" Copyright 2020 Joyent, Inc.
.TH ZONES 5 "May 23, 2021"
.SH NAME
zones \- Solaris application containers
.SH DESCRIPTION
The zones facility in Solaris provides an isolated environment for running
applications. Processes running in a zone are prevented from monitoring or
interfering with other activity in the system. Access to other processes,
network interfaces, file systems, devices, and inter-process communication
facilities are restricted to prevent interaction between processes in different
zones.
.sp
.LP
The privileges available within a zone are restricted to prevent operations
with system-wide impact. See \fBprivileges\fR(5).
.sp
.LP
You can configure and administer zones with the \fBzoneadm\fR(1M) and
\fBzonecfg\fR(1M) utilities. You can specify the configuration details a zone,
install file system contents including software packages into the zone, and
manage the runtime state of the zone. You can use the \fBzlogin\fR(1) to run
commands within an active zone. You can do this without logging in through a
network-based login server such as \fBsshd\fR(1M).
.sp
.LP
The autobooting of zones is enabled and disabled by the zones service,
identified by the FMRI:
.sp
.LP
svc:/system/zones:default
.sp
.LP
See \fBzoneadm\fR(1M). Note that a zone has an \fBautoboot\fR property, which
can be set to \fBtrue\fR (always autoboot). However, if the zones service is
disabled, autoboot will not occur, regardless of the setting of the autoboot
property for a given zone. See \fBzonecfg\fR(1M).
.sp
.LP
An alphanumeric name and numeric ID identify each active zone. Alphanumeric
names are configured using the \fBzonecfg\fR(1M) utility. Numeric IDs are
automatically assigned when the zone is booted. The \fBzonename\fR(1) utility
reports the current zone name, and the \fBzoneadm\fR(1M) utility can be used to
report the names and IDs of configured zones.
.sp
.LP
A zone can be in one of several states:
.sp
.ne 2
.na
\fB\fBCONFIGURED\fR\fR
.ad
.RS 17n
Indicates that the configuration for the zone has been completely specified and
committed to stable storage.
.RE
.sp
.ne 2
.na
\fB\fBINCOMPLETE\fR\fR
.ad
.RS 17n
Indicates that the zone is in the midst of being installed or uninstalled, or
was interrupted in the midst of such a transition.
.RE
.sp
.ne 2
.na
\fB\fBINSTALLED\fR\fR
.ad
.RS 17n
Indicates that the zone's configuration has been instantiated on the system:
packages have been installed under the zone's root path.
.RE
.sp
.ne 2
.na
\fB\fBREADY\fR\fR
.ad
.RS 17n
Indicates that the "virtual platform" for the zone has been established. For
instance, file systems have been mounted, devices have been configured, but no
processes associated with the zone have been started.
.RE
.sp
.ne 2
.na
\fB\fBRUNNING\fR\fR
.ad
.RS 17n
Indicates that user processes associated with the zone application environment
are running.
.RE
.sp
.ne 2
.na
\fB\fBSHUTTING_DOWN\fR\fR
.ad
.br
.na
\fB\fBDOWN\fR\fR
.ad
.RS 17n
Indicates that the zone is being halted. The zone can become stuck in one of
these states if it is unable to tear down the application environment state
(such as mounted file systems) or if some portion of the virtual platform
cannot be destroyed. Such cases require operator intervention.
.RE
.SS "Process Access Restrictions"
Processes running inside a zone (aside from the global zone) have restricted
access to other processes. Only processes in the same zone are visible through
\fB/proc\fR (see \fBproc\fR(4) or through system call interfaces that take
process IDs such as \fBkill\fR(2) and \fBpriocntl\fR(2). Attempts to access
processes that exist in other zones (including the global zone) fail with the
same error code that would be issued if the specified process did not exist.
.SS "Privilege Restrictions"
Processes running within a non-global zone are restricted to a subset of
privileges, in order to prevent one zone from being able to perform operations
that might affect other zones. The set of privileges limits the capabilities of
privileged users (such as the super-user or root user) within the zone. The
list of privileges available within a zone can be displayed using the
\fBppriv\fR(1) utility. For more information about privileges, see
\fBprivileges\fR(5).
.SS "Device Restrictions"
The set of devices available within a zone is restricted, to prevent a process
in one zone from interfering with processes in other zones. For example, a
process in a zone should not be able to modify kernel memory using
\fB/dev/kmem\fR, or modify the contents of the root disk. Thus, by default,
only a few pseudo devices considered safe for use within a zone are available.
Additional devices can be made available within specific zones using the
\fBzonecfg\fR(1M) utility.
.sp
.LP
The device and privilege restrictions have a number of effects on the utilities
that can run in a non-global zone. For example, the \fBeeprom\fR(1M),
\fBprtdiag\fR(1M), and \fBprtconf\fR(1M) utilities do not work in a zone since
they rely on devices that are not normally available.
.SS "Brands"
A zone may be assigned a brand when it is initially created. A branded zone is
one whose software does not match that software found in the global zone. The
software may include Solaris software configured or laid out differently, or it
may include non-Solaris software. The particular collection of software is
called a "brand" (see \fBbrands\fR(5)). Once installed, a zone's brand may not
be changed unless the zone is first uninstalled.
.SS "File Systems"
Each zone has its own section of the file system hierarchy, rooted at a
directory known as the zone root. Processes inside the zone can access only
files within that part of the hierarchy, that is, files that are located
beneath the zone root. This prevents processes in one zone from corrupting or
examining file system data associated with another zone. The \fBchroot\fR(1M)
utility can be used within a zone, but can only restrict the process to a root
path accessible within the zone.
.sp
.LP
In order to preserve file system space, sections of the file system can be
mounted into one or more zones using the read-only option of the
\fBlofs\fR(7FS) file system. This allows the same file system data to be shared
in multiple zones, while preserving the security guarantees supplied by zones.
.sp
.LP
NFS and autofs mounts established within a zone are local to that zone; they
cannot be accessed from other zones, including the global zone. The mounts are
removed when the zone is halted or rebooted.
.sp
.LP
A zone can share filesystems using \fBnfs\fR(4) or \fBsmb\fR(4)
subject to the restrictions earlier in this section, plus the additional
restriction that file sharing can only be done from filesystems a zone
completely controls. Some \fBbrands\fR(5) do not have the zone root set to a
filesystem boundary. \fBsharefs\fR(7FS) can instantiate per-zone subject to
the brand restrictions.
.SS "Networking"
A zone has its own port number space for \fBTCP\fR, \fBUDP\fR, and \fBSCTP\fR
applications and typically one or more separate \fBIP\fR addresses (but some
configurations of Trusted Extensions share IP address(es) between zones).
.sp
.LP
For the \fBIP\fR layer (\fBIP\fR routing, \fBARP\fR, \fBIPsec\fR, \fBIP\fR
Filter, and so on) a zone can either share the configuration and state with the
global zone (a shared-\fBIP\fR zone), or have its distinct \fBIP\fR layer
configuration and state (an exclusive-\fBIP\fR zone).
.sp
.LP
If a zone is to be connected to the same datalink, that is, be on the same
\fBIP\fR subnet or subnets as the global zone, then it is appropriate for the
zone to use the shared \fBIP\fR instance.
.sp
.LP
If a zone needs to be isolated at the \fBIP\fR layer on the network, for
instance being connected to different \fBVLAN\fRs or different \fBLAN\fRs than
the global zone and other non-global zones, then for isolation reasons the zone
should have its exclusive \fBIP\fR.
.sp
.LP
A shared-\fBIP\fR zone is prevented from doing certain things towards the
network (such as changing its \fBIP\fR address or sending spoofed \fBIP\fR or
Ethernet packets), but an exclusive-\fBIP\fR zone has more or less the same
capabilities towards the network as a separate host that is connected to the
same network interface. In particular, the superuser in such a zone can change
its \fBIP\fR address and spoof \fBARP\fR packets.
.sp
.LP
The shared-\fBIP\fR zones are assigned one or more network interface names and
\fBIP\fR addresses in \fBzonecfg\fR(1M). The network interface name(s) must
also be configured in the global zone.
.sp
.LP
The exclusive-\fBIP\fR zones are assigned one or more network interface names
in \fBzonecfg\fR(1M). The network interface names must be exclusively assigned
to that zone, that is, it (or they) can not be assigned to some other running
zone, nor can they be used by the global zone.
.sp
.LP
The full \fBIP\fR-level functionality in the form of \fBDHCP\fR client,
\fBIPsec\fR and \fBIP\fR Filter, is available in exclusive-\fBIP\fR zones and
not in shared-\fBIP\fR zones.
.SS "Host Identifiers"
A zone is capable of emulating a 32-bit host identifier, which can be
configured via \fBzonecfg\fR(1M), for the purpose of system consolidation. If a
zone emulates a host identifier, then commands such as \fBhostid\fR(1) and
\fBsysdef\fR(1M) as well as C interfaces such as \fBsysinfo\fR(2) and
\fBgethostid\fR(3C) that are executed within the context of the zone will
display or return the zone's emulated host identifier rather than the host
machine's identifier.
.SH SEE ALSO
\fBhostid\fR(1), \fBzlogin\fR(1), \fBzonename\fR(1),
\fBsshd\fR(1M), \fBsysdef\fR(1M), \fBzoneadm\fR(1M), \fBzonecfg\fR(1M),
\fBkill\fR(2), \fBpriocntl\fR(2), \fBsysinfo\fR(2), \fBgethostid\fR(3C),
\fBgetzoneid\fR(3C), \fBucred_get\fR(3C), \fBnfs\fR(4), \fBproc\fR(4),
\fBsmb\fR(4), \fBattributes\fR(5), \fBbrands\fR(5), \fBprivileges\fR(5),
\fBsharefs\fR(7FS), \fBcrgetzoneid\fR(9F)