| blob | 5e7e8a7d560a02160d452319209dea2e4024b4e5 |
1 '\" te
2 .\" Copyright (c) 2004, 2009 Sun Microsystems, Inc. All Rights Reserved.
3 .\" Copyright 2013 Joyent, Inc. All Rights Reserved.
4 .\" Copyright 2017 Peter Tribble
5 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
6 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
7 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
8 .TH ZONECFG 8 "Jul 24, 2017"
9 .SH NAME
10 zonecfg \- set up zone configuration
11 .SH SYNOPSIS
12 .LP
13 .nf
14 \fBzonecfg\fR \fB-z\fR \fIzonename\fR
15 .fi
17 .LP
18 .nf
19 \fBzonecfg\fR \fB-z\fR \fIzonename\fR \fIsubcommand\fR
20 .fi
22 .LP
23 .nf
24 \fBzonecfg\fR \fB-z\fR \fIzonename\fR \fB-f\fR \fIcommand_file\fR
25 .fi
27 .LP
28 .nf
29 \fBzonecfg\fR help
30 .fi
32 .SH DESCRIPTION
33 .LP
34 The \fBzonecfg\fR utility creates and modifies the configuration of a zone.
35 Zone configuration consists of a number of resources and properties.
36 .sp
37 .LP
38 To simplify the user interface, \fBzonecfg\fR uses the concept of a scope. The
39 default scope is global.
40 .sp
41 .LP
42 The following synopsis of the \fBzonecfg\fR command is for interactive usage:
43 .sp
44 .in +2
45 .nf
46 zonecfg \fB-z\fR \fIzonename subcommand\fR
47 .fi
48 .in -2
49 .sp
51 .sp
52 .LP
53 Parameters changed through \fBzonecfg\fR do not affect a running zone. The zone
54 must be rebooted for the changes to take effect.
55 .sp
56 .LP
57 In addition to creating and modifying a zone, the \fBzonecfg\fR utility can
58 also be used to persistently specify the resource management settings for the
59 global zone.
60 .sp
61 .LP
62 In the following text, "rctl" is used as an abbreviation for "resource
63 control". See \fBresource_controls\fR(5).
64 .sp
65 .LP
66 Every zone is configured with an associated brand. The brand determines the
67 user-level environment used within the zone, as well as various behaviors for
68 the zone when it is installed, boots, or is shutdown. Once a zone has been
69 installed the brand cannot be changed. The default brand is determined by the
70 installed distribution in the global zone. Some brands do not support all of
71 the \fBzonecfg\fR properties and resources. See the brand-specific man page for
72 more details on each brand. For an overview of brands, see the \fBbrands\fR(5)
73 man page.
74 .SS "Resources"
75 .LP
76 The following resource types are supported:
77 .sp
78 .ne 2
79 .na
80 \fB\fBattr\fR\fR
81 .ad
82 .sp .6
83 .RS 4n
84 Generic attribute.
85 .RE
87 .sp
88 .ne 2
89 .na
90 \fB\fBcapped-cpu\fR\fR
91 .ad
92 .sp .6
93 .RS 4n
94 Limits for CPU usage.
95 .RE
97 .sp
98 .ne 2
99 .na
100 \fB\fBcapped-memory\fR\fR
101 .ad
102 .sp .6
103 .RS 4n
104 Limits for physical, swap, and locked memory.
105 .RE
107 .sp
108 .ne 2
109 .na
110 \fB\fBdataset\fR\fR
111 .ad
112 .sp .6
113 .RS 4n
114 \fBZFS\fR dataset.
115 .RE
117 .sp
118 .ne 2
119 .na
120 \fB\fBdedicated-cpu\fR\fR
121 .ad
122 .sp .6
123 .RS 4n
124 Subset of the system's processors dedicated to this zone while it is running.
125 .RE
127 .sp
128 .ne 2
129 .na
130 \fB\fBdevice\fR\fR
131 .ad
132 .sp .6
133 .RS 4n
134 Device.
135 .RE
137 .sp
138 .ne 2
139 .na
140 \fB\fBfs\fR\fR
141 .ad
142 .sp .6
143 .RS 4n
144 file-system
145 .RE
147 .sp
148 .ne 2
149 .na
150 \fB\fBnet\fR\fR
151 .ad
152 .sp .6
153 .RS 4n
154 Network interface.
155 .RE
157 .sp
158 .ne 2
159 .na
160 \fB\fBrctl\fR\fR
161 .ad
162 .sp .6
163 .RS 4n
164 Resource control.
165 .RE
167 .sp
168 .ne 2
169 .na
170 \fB\fBsecurity-flags\fR\fR
171 .ad
172 .sp .6
173 .RS 4n
174 Process security flag settings.
175 .RE
177 .sp
178 .ne 2
179 .na
180 \fB\fBadmin\fR\fR
181 .ad
182 .sp .6
183 .RS 4n
184 Delegation of administration to specific users.
185 .RE
187 .SS "Properties"
188 .LP
189 Each resource type has one or more properties. There are also some global
190 properties, that is, properties of the configuration as a whole, rather than of
191 some particular resource.
192 .sp
193 .LP
194 The following properties are supported:
195 .sp
196 .ne 2
197 .na
198 \fB(global)\fR
199 .ad
200 .sp .6
201 .RS 4n
202 \fBzonename\fR
203 .RE
205 .sp
206 .ne 2
207 .na
208 \fB(global)\fR
209 .ad
210 .sp .6
211 .RS 4n
212 \fBzonepath\fR
213 .RE
215 .sp
216 .ne 2
217 .na
218 \fB(global)\fR
219 .ad
220 .sp .6
221 .RS 4n
222 \fBautoboot\fR
223 .RE
225 .sp
226 .ne 2
227 .na
228 \fB(global)\fR
229 .ad
230 .sp .6
231 .RS 4n
232 \fBbootargs\fR
233 .RE
235 .sp
236 .ne 2
237 .na
238 \fB(global)\fR
239 .ad
240 .sp .6
241 .RS 4n
242 \fBpool\fR
243 .RE
245 .sp
246 .ne 2
247 .na
248 \fB(global)\fR
249 .ad
250 .sp .6
251 .RS 4n
252 \fBlimitpriv\fR
253 .RE
255 .sp
256 .ne 2
257 .na
258 \fB(global)\fR
259 .ad
260 .sp .6
261 .RS 4n
262 \fBbrand\fR
263 .RE
265 .sp
266 .ne 2
267 .na
268 \fB(global)\fR
269 .ad
270 .sp .6
271 .RS 4n
272 \fBcpu-shares\fR
273 .RE
275 .sp
276 .ne 2
277 .na
278 \fB(global)\fR
279 .ad
280 .sp .6
281 .RS 4n
282 \fBhostid\fR
283 .RE
285 .sp
286 .ne 2
287 .na
288 \fB(global)\fR
289 .ad
290 .sp .6
291 .RS 4n
292 \fBmax-lwps\fR
293 .RE
295 .sp
296 .ne 2
297 .na
298 \fB(global)\fR
299 .ad
300 .sp .6
301 .RS 4n
302 \fBmax-msg-ids\fR
303 .RE
305 .sp
306 .ne 2
307 .na
308 \fB(global)\fR
309 .ad
310 .sp .6
311 .RS 4n
312 \fBmax-sem-ids\fR
313 .RE
315 .sp
316 .ne 2
317 .na
318 \fB(global)\fR
319 .ad
320 .sp .6
321 .RS 4n
322 \fBmax-shm-ids\fR
323 .RE
325 .sp
326 .ne 2
327 .na
328 \fB(global)\fR
329 .ad
330 .sp .6
331 .RS 4n
332 \fBmax-shm-memory\fR
333 .RE
335 .sp
336 .ne 2
337 .na
338 \fB(global)\fR
339 .ad
340 .sp .6
341 .RS 4n
342 \fBscheduling-class\fR
343 .RE
345 .sp
346 .ne 2
347 .na
348 .B (global)
349 .ad
350 .sp .6
351 .RS 4n
352 .B fs-allowed
353 .RE
355 .sp
356 .ne 2
357 .na
358 \fB\fBfs\fR\fR
359 .ad
360 .sp .6
361 .RS 4n
362 \fBdir\fR, \fBspecial\fR, \fBraw\fR, \fBtype\fR, \fBoptions\fR
363 .RE
365 .sp
366 .ne 2
367 .na
368 \fB\fBnet\fR\fR
369 .ad
370 .sp .6
371 .RS 4n
372 \fBaddress\fR, \fBallowed-address\fR, \fBphysical\fR, \fBdefrouter\fR
373 .RE
375 .sp
376 .ne 2
377 .na
378 \fB\fBdevice\fR\fR
379 .ad
380 .sp .6
381 .RS 4n
382 \fBmatch\fR
383 .RE
385 .sp
386 .ne 2
387 .na
388 \fB\fBrctl\fR\fR
389 .ad
390 .sp .6
391 .RS 4n
392 \fBname\fR, \fBvalue\fR
393 .RE
395 .sp
396 .ne 2
397 .na
398 \fB\fBattr\fR\fR
399 .ad
400 .sp .6
401 .RS 4n
402 \fBname\fR, \fBtype\fR, \fBvalue\fR
403 .RE
405 .sp
406 .ne 2
407 .na
408 \fB\fBdataset\fR\fR
409 .ad
410 .sp .6
411 .RS 4n
412 \fBname\fR
413 .RE
415 .sp
416 .ne 2
417 .na
418 \fB\fBdedicated-cpu\fR\fR
419 .ad
420 .sp .6
421 .RS 4n
422 \fBncpus\fR, \fBimportance\fR
423 .RE
425 .sp
426 .ne 2
427 .na
428 \fB\fBcapped-memory\fR\fR
429 .ad
430 .sp .6
431 .RS 4n
432 \fBphysical\fR, \fBswap\fR, \fBlocked\fR
433 .RE
435 .sp
436 .ne 2
437 .na
438 \fB\fBcapped-cpu\fR\fR
439 .ad
440 .sp .6
441 .RS 4n
442 \fBncpus\fR
443 .RE
445 .sp
446 .ne 2
447 .na
448 \fB\fBsecurity-flags\fR\fR
449 .ad
450 .sp .6
451 .RS 4n
452 \fBlower\fR, \fBdefault\fR, \fBupper\fR.
453 .RE
455 .sp
456 .ne 2
457 .na
458 \fB\fBadmin\fR\fR
459 .ad
460 .sp .6
461 .RS 4n
462 \fBuser\fR, \fBauths\fR.
463 .RE
465 .sp
466 .LP
467 As for the property values which are paired with these names, they are either
468 simple, complex, or lists. The type allowed is property-specific. Simple values
469 are strings, optionally enclosed within quotation marks. Complex values have
470 the syntax:
471 .sp
472 .in +2
473 .nf
474 (<\fIname\fR>=<\fIvalue\fR>,<\fIname\fR>=<\fIvalue\fR>,...)
475 .fi
476 .in -2
477 .sp
479 .sp
480 .LP
481 where each <\fIvalue\fR> is simple, and the <\fIname\fR> strings are unique
482 within a given property. Lists have the syntax:
483 .sp
484 .in +2
485 .nf
486 [<\fIvalue\fR>,...]
487 .fi
488 .in -2
489 .sp
491 .sp
492 .LP
493 where each <\fIvalue\fR> is either simple or complex. A list of a single value
494 (either simple or complex) is equivalent to specifying that value without the
495 list syntax. That is, "foo" is equivalent to "[foo]". A list can be empty
496 (denoted by "[]").
497 .sp
498 .LP
499 In interpreting property values, \fBzonecfg\fR accepts regular expressions as
500 specified in \fBfnmatch\fR(5). See \fBEXAMPLES\fR.
501 .sp
502 .LP
503 The property types are described as follows:
504 .sp
505 .ne 2
506 .na
507 \fBglobal: \fBzonename\fR\fR
508 .ad
509 .sp .6
510 .RS 4n
511 The name of the zone.
512 .RE
514 .sp
515 .ne 2
516 .na
517 \fBglobal: \fBzonepath\fR\fR
518 .ad
519 .sp .6
520 .RS 4n
521 Path to zone's file system.
522 .RE
524 .sp
525 .ne 2
526 .na
527 \fBglobal: \fBautoboot\fR\fR
528 .ad
529 .sp .6
530 .RS 4n
531 Boolean indicating that a zone should be booted automatically at system boot.
532 Note that if the zones service is disabled, the zone will not autoboot,
533 regardless of the setting of this property. You enable the zones service with a
534 \fBsvcadm\fR command, such as:
535 .sp
536 .in +2
537 .nf
538 # \fBsvcadm enable svc:/system/zones:default\fR
539 .fi
540 .in -2
541 .sp
543 Replace \fBenable\fR with \fBdisable\fR to disable the zones service. See
544 \fBsvcadm\fR(8).
545 .RE
547 .sp
548 .ne 2
549 .na
550 \fBglobal: \fBbootargs\fR\fR
551 .ad
552 .sp .6
553 .RS 4n
554 Arguments (options) to be passed to the zone bootup, unless options are
555 supplied to the "\fBzoneadm boot\fR" command, in which case those take
556 precedence. The valid arguments are described in \fBzoneadm\fR(8).
557 .RE
559 .sp
560 .ne 2
561 .na
562 \fBglobal: \fBpool\fR\fR
563 .ad
564 .sp .6
565 .RS 4n
566 Name of the resource pool that this zone must be bound to when booted. This
567 property is incompatible with the \fBdedicated-cpu\fR resource.
568 .RE
570 .sp
571 .ne 2
572 .na
573 \fBglobal: \fBlimitpriv\fR\fR
574 .ad
575 .sp .6
576 .RS 4n
577 The maximum set of privileges any process in this zone can obtain. The property
578 should consist of a comma-separated privilege set specification as described in
579 \fBpriv_str_to_set\fR(3C). Privileges can be excluded from the resulting set by
580 preceding their names with a dash (-) or an exclamation point (!). The special
581 privilege string "zone" is not supported in this context. If the special string
582 "default" occurs as the first token in the property, it expands into a safe set
583 of privileges that preserve the resource and security isolation described in
584 \fBzones\fR(5). A missing or empty property is equivalent to this same set of
585 safe privileges.
586 .sp
587 The system administrator must take extreme care when configuring privileges for
588 a zone. Some privileges cannot be excluded through this mechanism as they are
589 required in order to boot a zone. In addition, there are certain privileges
590 which cannot be given to a zone as doing so would allow processes inside a zone
591 to unduly affect processes in other zones. \fBzoneadm\fR(8) indicates when an
592 invalid privilege has been added or removed from a zone's privilege set when an
593 attempt is made to either "boot" or "ready" the zone.
594 .sp
595 See \fBprivileges\fR(5) for a description of privileges. The command "\fBppriv
596 -l\fR" (see \fBppriv\fR(1)) produces a list of all Solaris privileges. You can
597 specify privileges as they are displayed by \fBppriv\fR. In
598 \fBprivileges\fR(5), privileges are listed in the form
599 PRIV_\fIprivilege_name\fR. For example, the privilege \fIsys_time\fR, as you
600 would specify it in this property, is listed in \fBprivileges\fR(5) as
601 \fBPRIV_SYS_TIME\fR.
602 .RE
604 .sp
605 .ne 2
606 .na
607 \fBglobal: \fBbrand\fR\fR
608 .ad
609 .sp .6
610 .RS 4n
611 The zone's brand type.
612 .RE
614 .sp
615 .ne 2
616 .na
617 \fBglobal: \fBip-type\fR\fR
618 .ad
619 .sp .6
620 .RS 4n
621 A zone can either share the IP instance with the global zone, which is the
622 default, or have its own exclusive instance of IP.
623 .sp
624 This property takes the values \fBshared\fR and \fBexclusive\fR.
625 .RE
627 .sp
628 .ne 2
629 .na
630 \fBglobal: \fBhostid\fR\fR
631 .ad
632 .sp .6
633 .RS 4n
634 A zone can emulate a 32-bit host identifier to ease system consolidation. A
635 zone's \fBhostid\fR property is empty by default, meaning that the zone does
636 not emulate a host identifier. Zone host identifiers must be hexadecimal values
637 between 0 and FFFFFFFE. A \fB0x\fR or \fB0X\fR prefix is optional. Both
638 uppercase and lowercase hexadecimal digits are acceptable.
639 .RE
641 .sp
642 .ne 2
643 .na
644 \fB\fBfs\fR: dir, special, raw, type, options\fR
645 .ad
646 .sp .6
647 .RS 4n
648 Values needed to determine how, where, and so forth to mount file systems. See
649 \fBmount\fR(8), \fBmount\fR(2), \fBfsck\fR(8), and \fBvfstab\fR(4).
650 .RE
652 .sp
653 .ne 2
654 .na
655 \fB\fBnet\fR: address, allowed-address, physical, defrouter\fR
656 .ad
657 .sp .6
658 .RS 4n
659 The network address and physical interface name of the network interface. The
660 network address is one of:
661 .RS +4
662 .TP
663 .ie t \(bu
664 .el o
665 a valid IPv4 address, optionally followed by "\fB/\fR" and a prefix length;
666 .RE
667 .RS +4
668 .TP
669 .ie t \(bu
670 .el o
671 a valid IPv6 address, which must be followed by "\fB/\fR" and a prefix length;
672 .RE
673 .RS +4
674 .TP
675 .ie t \(bu
676 .el o
677 a host name which resolves to an IPv4 address.
678 .RE
679 Note that host names that resolve to IPv6 addresses are not supported.
680 .sp
681 The physical interface name is the network interface name.
682 .sp
683 The default router is specified similarly to the network address except that it
684 must not be followed by a \fB/\fR (slash) and a network prefix length.
685 .sp
686 A zone can be configured to be either exclusive-IP or shared-IP. For a
687 shared-IP zone, you must set both the physical and address properties; setting
688 the default router is optional. The interface specified in the physical
689 property must be plumbed in the global zone prior to booting the non-global
690 zone. However, if the interface is not used by the global zone, it should be
691 configured \fBdown\fR in the global zone, and the default router for the
692 interface should be specified here.
693 .sp
694 For an exclusive-IP zone, the physical property must be set and the address and
695 default router properties cannot be set.
696 .sp
697 An exclusive-IP zone is responsible for managing its own network configuration.
698 If the allowed-address property is set, the zone administrator will only be
699 permitted to configure the interface with the specified address. To allow
700 multiple addresses (for example, an IPv4 and IPv6 address), use add net
701 multiple times.
702 .RE
704 .sp
705 .ne 2
706 .na
707 \fB\fBdevice\fR: match\fR
708 .ad
709 .sp .6
710 .RS 4n
711 Device name to match.
712 .RE
714 .sp
715 .ne 2
716 .na
717 \fB\fBrctl\fR: name, value\fR
718 .ad
719 .sp .6
720 .RS 4n
721 The name and \fIpriv\fR/\fIlimit\fR/\fIaction\fR triple of a resource control.
722 See \fBprctl\fR(1) and \fBrctladm\fR(8). The preferred way to set rctl values
723 is to use the global property name associated with a specific rctl.
724 .RE
726 .sp
727 .ne 2
728 .na
729 \fB\fBattr\fR: name, type, value\fR
730 .ad
731 .sp .6
732 .RS 4n
733 The name, type and value of a generic attribute. The \fBtype\fR must be one of
734 \fBint\fR, \fBuint\fR, \fBboolean\fR or \fBstring\fR, and the value must be of
735 that type. \fBuint\fR means unsigned, that is, a non-negative integer.
736 .RE
738 .sp
739 .ne 2
740 .na
741 \fB\fBdataset\fR: name\fR
742 .ad
743 .sp .6
744 .RS 4n
745 The name of a \fBZFS\fR dataset to be accessed from within the zone. See
746 \fBzfs\fR(8).
747 .RE
749 .sp
750 .ne 2
751 .na
752 \fBglobal: \fBcpu-shares\fR\fR
753 .ad
754 .sp .6
755 .RS 4n
756 The number of Fair Share Scheduler (FSS) shares to allocate to this zone. This
757 property is incompatible with the \fBdedicated-cpu\fR resource. This property
758 is the preferred way to set the \fBzone.cpu-shares\fR rctl.
759 .RE
761 .sp
762 .ne 2
763 .na
764 \fBglobal: \fBmax-lwps\fR\fR
765 .ad
766 .sp .6
767 .RS 4n
768 The maximum number of LWPs simultaneously available to this zone. This property
769 is the preferred way to set the \fBzone.max-lwps\fR rctl.
770 .RE
772 .sp
773 .ne 2
774 .na
775 \fBglobal: \fBmax-msg-ids\fR\fR
776 .ad
777 .sp .6
778 .RS 4n
779 The maximum number of message queue IDs allowed for this zone. This property is
780 the preferred way to set the \fBzone.max-msg-ids\fR rctl.
781 .RE
783 .sp
784 .ne 2
785 .na
786 \fBglobal: \fBmax-sem-ids\fR\fR
787 .ad
788 .sp .6
789 .RS 4n
790 The maximum number of semaphore IDs allowed for this zone. This property is the
791 preferred way to set the \fBzone.max-sem-ids\fR rctl.
792 .RE
794 .sp
795 .ne 2
796 .na
797 \fBglobal: \fBmax-shm-ids\fR\fR
798 .ad
799 .sp .6
800 .RS 4n
801 The maximum number of shared memory IDs allowed for this zone. This property is
802 the preferred way to set the \fBzone.max-shm-ids\fR rctl.
803 .RE
805 .sp
806 .ne 2
807 .na
808 \fBglobal: \fBmax-shm-memory\fR\fR
809 .ad
810 .sp .6
811 .RS 4n
812 The maximum amount of shared memory allowed for this zone. This property is the
813 preferred way to set the \fBzone.max-shm-memory\fR rctl. A scale (K, M, G, T)
814 can be applied to the value for this number (for example, 8 is one megabyte).
815 .RE
817 .sp
818 .ne 2
819 .na
820 \fBglobal: \fBscheduling-class\fR\fR
821 .ad
822 .sp .6
823 .RS 4n
824 Specifies the scheduling class used for processes running in a zone. When this
825 property is not specified, the scheduling class is established as follows:
826 .RS +4
827 .TP
828 .ie t \(bu
829 .el o
830 If the \fBcpu-shares\fR property or equivalent rctl is set, the scheduling
831 class FSS is used.
832 .RE
833 .RS +4
834 .TP
835 .ie t \(bu
836 .el o
837 If neither \fBcpu-shares\fR nor the equivalent rctl is set and the zone's pool
838 property references a pool that has a default scheduling class, that class is
839 used.
840 .RE
841 .RS +4
842 .TP
843 .ie t \(bu
844 .el o
845 Under any other conditions, the system default scheduling class is used.
846 .RE
847 .RE
851 .sp
852 .ne 2
853 .na
854 \fB\fBdedicated-cpu\fR: ncpus, importance\fR
855 .ad
856 .sp .6
857 .RS 4n
858 The number of CPUs that should be assigned for this zone's exclusive use. The
859 zone will create a pool and processor set when it boots. See \fBpooladm\fR(8)
860 and \fBpoolcfg\fR(8) for more information on resource pools. The \fBncpu\fR
861 property can specify a single value or a range (for example, 1-4) of
862 processors. The \fBimportance\fR property is optional; if set, it will specify
863 the \fBpset.importance\fR value for use by \fBpoold\fR(8). If this resource is
864 used, there must be enough free processors to allocate to this zone when it
865 boots or the zone will not boot. The processors assigned to this zone will not
866 be available for the use of the global zone or other zones. This resource is
867 incompatible with both the \fBpool\fR and \fBcpu-shares\fR properties. Only a
868 single instance of this resource can be added to the zone.
869 .RE
871 .sp
872 .ne 2
873 .na
874 \fB\fBcapped-memory\fR: physical, swap, locked\fR
875 .ad
876 .sp .6
877 .RS 4n
878 The caps on the memory that can be used by this zone. A scale (K, M, G, T) can
879 be applied to the value for each of these numbers (for example, 8 is one
880 megabyte). Each of these properties is optional but at least one property must
881 be set when adding this resource. Only a single instance of this resource can
882 be added to the zone. The \fBphysical\fR property sets the \fBmax-rss\fR for
883 this zone. This will be enforced by \fBrcapd\fR(8) running in the global zone.
884 The \fBswap\fR property is the preferred way to set the \fBzone.max-swap\fR
885 rctl. The \fBlocked\fR property is the preferred way to set the
886 \fBzone.max-locked-memory\fR rctl.
887 .RE
889 .sp
890 .ne 2
891 .na
892 \fB\fBcapped-cpu\fR: ncpus\fR
893 .ad
894 .sp .6
895 .RS 4n
896 Sets a limit on the amount of CPU time that can be used by a zone. The unit
897 used translates to the percentage of a single CPU that can be used by all user
898 threads in a zone, expressed as a fraction (for example, \fB\&.75\fR) or a
899 mixed number (whole number and fraction, for example, \fB1.25\fR). An
900 \fBncpu\fR value of \fB1\fR means 100% of a CPU, a value of \fB1.25\fR means
901 125%, \fB\&.75\fR mean 75%, and so forth. When projects within a capped zone
902 have their own caps, the minimum value takes precedence.
903 .sp
904 The \fBcapped-cpu\fR property is an alias for \fBzone.cpu-cap\fR resource
905 control and is related to the \fBzone.cpu-cap\fR resource control. See
906 \fBresource_controls\fR(5).
907 .RE
909 .sp
910 .ne 2
911 .na
912 \fB\fBsecurity-flags\fR: lower, default, upper\fR
913 .ad
914 .sp .6
915 .RS 4n
916 Set the process security flags associated with the zone. The \fBlower\fR and
917 \fBupper\fR fields set the limits, the \fBdefault\fR field is set of flags all
918 zone processes inherit.
919 .RE
921 .sp
922 .ne 2
923 .na
924 \fB\fBadmin\fR: user, auths\fR
925 .ad
926 .sp .6
927 .RS 4n
928 Delegate zone administration to the named user. Valid values for \fBauths\fR
929 are \fBlogin\fR, \fBmanage\fR, and \fBclonefrom\fR. The \fBlogin\fR
930 authorization enables the user to use \fBzlogin\fR(1) to log in to the zone,
931 being prompted for authentication (but not to access the zone console). The
932 \fBmanage\fR authorization enables the user to install, update, boot or halt
933 the zone, to log in using \fBzlogin\fR(1) without authentication, and to access
934 the zone console. The \fBclonefrom\fR authorization allows the user to install
935 a new zone using this zone as a clone source.
936 .RE
938 .sp
939 .ne 2
940 .na
941 \fBglobal: \fBfs-allowed\fR\fR
942 .ad
943 .sp .6
944 .RS 4n
945 A comma-separated list of additional filesystems that may be mounted within
946 the zone; for example "ufs,pcfs". By default, only hsfs(7fs) and network
947 filesystems can be mounted. If the first entry in the list is "-" then
948 that disables all of the default filesystems. If any filesystems are listed
949 after "-" then only those filesystems can be mounted.
951 This property does not apply to filesystems mounted into the zone via "add fs"
952 or "add dataset".
954 WARNING: allowing filesystem mounts other than the default may allow the zone
955 administrator to compromise the system with a malicious filesystem image, and
956 is not supported.
957 .RE
959 .sp
960 .LP
961 The following table summarizes resources, property-names, and types:
962 .sp
963 .in +2
964 .nf
965 resource property-name type
966 (global) zonename simple
967 (global) zonepath simple
968 (global) autoboot simple
969 (global) bootargs simple
970 (global) pool simple
971 (global) limitpriv simple
972 (global) brand simple
973 (global) ip-type simple
974 (global) hostid simple
975 (global) cpu-shares simple
976 (global) max-lwps simple
977 (global) max-msg-ids simple
978 (global) max-sem-ids simple
979 (global) max-shm-ids simple
980 (global) max-shm-memory simple
981 (global) scheduling-class simple
982 fs dir simple
983 special simple
984 raw simple
985 type simple
986 options list of simple
987 net address simple
988 physical simple
989 device match simple
990 rctl name simple
991 value list of complex
992 attr name simple
993 type simple
994 value simple
995 dataset name simple
996 dedicated-cpu ncpus simple or range
997 importance simple
999 capped-memory physical simple with scale
1000 swap simple with scale
1001 locked simple with scale
1003 capped-cpu ncpus simple
1004 security-flags lower simple
1005 default simple
1006 upper simple
1007 admin user simple
1008 auths simple
1009 .fi
1010 .in -2
1011 .sp
1013 .sp
1014 .LP
1015 To further specify things, the breakdown of the complex property "value" of the
1016 "rctl" resource type, it consists of three name/value pairs, the names being
1017 "priv", "limit" and "action", each of which takes a simple value. The "name"
1018 property of an "attr" resource is syntactically restricted in a fashion similar
1019 but not identical to zone names: it must begin with an alphanumeric, and can
1020 contain alphanumerics plus the hyphen (\fB-\fR), underscore (\fB_\fR), and dot
1021 (\fB\&.\fR) characters. Attribute names beginning with "zone" are reserved for
1022 use by the system. Finally, the "autoboot" global property must have a value of
1023 "true" or "false".
1024 .SS "Using Kernel Statistics to Monitor CPU Caps"
1025 .LP
1026 Using the kernel statistics (\fBkstat\fR(3KSTAT)) module \fBcaps\fR, the system
1027 maintains information for all capped projects and zones. You can access this
1028 information by reading kernel statistics (\fBkstat\fR(3KSTAT)), specifying
1029 \fBcaps\fR as the \fBkstat\fR module name. The following command displays
1030 kernel statistics for all active CPU caps:
1031 .sp
1032 .in +2
1033 .nf
1034 # \fBkstat caps::'/cpucaps/'\fR
1035 .fi
1036 .in -2
1037 .sp
1039 .sp
1040 .LP
1041 A \fBkstat\fR(8) command running in a zone displays only CPU caps relevant for
1042 that zone and for projects in that zone. See \fBEXAMPLES\fR.
1043 .sp
1044 .LP
1045 The following are cap-related arguments for use with \fBkstat\fR(8):
1046 .sp
1047 .ne 2
1048 .na
1049 \fB\fBcaps\fR\fR
1050 .ad
1051 .sp .6
1052 .RS 4n
1053 The \fBkstat\fR module.
1054 .RE
1056 .sp
1057 .ne 2
1058 .na
1059 \fB\fBproject_caps\fR or \fBzone_caps\fR\fR
1060 .ad
1061 .sp .6
1062 .RS 4n
1063 \fBkstat\fR class, for use with the \fBkstat\fR \fB-c\fR option.
1064 .RE
1066 .sp
1067 .ne 2
1068 .na
1069 \fB\fBcpucaps_project_\fR\fIid\fR or \fBcpucaps_zone_\fR\fIid\fR\fR
1070 .ad
1071 .sp .6
1072 .RS 4n
1073 \fBkstat\fR name, for use with the \fBkstat\fR \fB-n\fR option. \fIid\fR is the
1074 project or zone identifier.
1075 .RE
1077 .sp
1078 .LP
1079 The following fields are displayed in response to a \fBkstat\fR(8) command
1080 requesting statistics for all CPU caps.
1081 .sp
1082 .ne 2
1083 .na
1084 \fB\fBmodule\fR\fR
1085 .ad
1086 .sp .6
1087 .RS 4n
1088 In this usage of \fBkstat\fR, this field will have the value \fBcaps\fR.
1089 .RE
1091 .sp
1092 .ne 2
1093 .na
1094 \fB\fBname\fR\fR
1095 .ad
1096 .sp .6
1097 .RS 4n
1098 As described above, \fBcpucaps_project_\fR\fIid\fR or
1099 \fBcpucaps_zone_\fR\fIid\fR
1100 .RE
1102 .sp
1103 .ne 2
1104 .na
1105 \fB\fBabove_sec\fR\fR
1106 .ad
1107 .sp .6
1108 .RS 4n
1109 Total time, in seconds, spent above the cap.
1110 .RE
1112 .sp
1113 .ne 2
1114 .na
1115 \fB\fBbelow_sec\fR\fR
1116 .ad
1117 .sp .6
1118 .RS 4n
1119 Total time, in seconds, spent below the cap.
1120 .RE
1122 .sp
1123 .ne 2
1124 .na
1125 \fB\fBmaxusage\fR\fR
1126 .ad
1127 .sp .6
1128 .RS 4n
1129 Maximum observed CPU usage.
1130 .RE
1132 .sp
1133 .ne 2
1134 .na
1135 \fB\fBnwait\fR\fR
1136 .ad
1137 .sp .6
1138 .RS 4n
1139 Number of threads on cap wait queue.
1140 .RE
1142 .sp
1143 .ne 2
1144 .na
1145 \fB\fBusage\fR\fR
1146 .ad
1147 .sp .6
1148 .RS 4n
1149 Current aggregated CPU usage for all threads belonging to a capped project or
1150 zone, in terms of a percentage of a single CPU.
1151 .RE
1153 .sp
1154 .ne 2
1155 .na
1156 \fB\fBvalue\fR\fR
1157 .ad
1158 .sp .6
1159 .RS 4n
1160 The cap value, in terms of a percentage of a single CPU.
1161 .RE
1163 .sp
1164 .ne 2
1165 .na
1166 \fB\fBzonename\fR\fR
1167 .ad
1168 .sp .6
1169 .RS 4n
1170 Name of the zone for which statistics are displayed.
1171 .RE
1173 .sp
1174 .LP
1175 See \fBEXAMPLES\fR for sample output from a \fBkstat\fR command.
1176 .SH OPTIONS
1177 .LP
1178 The following options are supported:
1179 .sp
1180 .ne 2
1181 .na
1182 \fB\fB-f\fR \fIcommand_file\fR\fR
1183 .ad
1184 .sp .6
1185 .RS 4n
1186 Specify the name of \fBzonecfg\fR command file. \fIcommand_file\fR is a text
1187 file of \fBzonecfg\fR subcommands, one per line.
1188 .RE
1190 .sp
1191 .ne 2
1192 .na
1193 \fB\fB-z\fR \fIzonename\fR\fR
1194 .ad
1195 .sp .6
1196 .RS 4n
1197 Specify the name of a zone. Zone names are case sensitive. Zone names must
1198 begin with an alphanumeric character and can contain alphanumeric characters,
1199 the underscore (\fB_\fR) the hyphen (\fB-\fR), and the dot (\fB\&.\fR). The
1200 name \fBglobal\fR and all names beginning with \fBSUNW\fR are reserved and
1201 cannot be used.
1202 .RE
1204 .SH SUBCOMMANDS
1205 .LP
1206 You can use the \fBadd\fR and \fBselect\fR subcommands to select a specific
1207 resource, at which point the scope changes to that resource. The \fBend\fR and
1208 \fBcancel\fR subcommands are used to complete the resource specification, at
1209 which time the scope is reverted back to global. Certain subcommands, such as
1210 \fBadd\fR, \fBremove\fR and \fBset\fR, have different semantics in each scope.
1211 .sp
1212 .LP
1213 \fBzonecfg\fR supports a semicolon-separated list of subcommands. For example:
1214 .sp
1215 .in +2
1216 .nf
1217 # \fBzonecfg -z myzone "add net; set physical=myvnic; end"\fR
1218 .fi
1219 .in -2
1220 .sp
1222 .sp
1223 .LP
1224 Subcommands which can result in destructive actions or loss of work have an
1225 \fB-F\fR option to force the action. If input is from a terminal device, the
1226 user is prompted when appropriate if such a command is given without the
1227 \fB-F\fR option otherwise, if such a command is given without the \fB-F\fR
1228 option, the action is disallowed, with a diagnostic message written to standard
1229 error.
1230 .sp
1231 .LP
1232 The following subcommands are supported:
1233 .sp
1234 .ne 2
1235 .na
1236 \fB\fBadd\fR \fIresource-type\fR (global scope)\fR
1237 .ad
1238 .br
1239 .na
1240 \fB\fBadd\fR \fIproperty-name property-value\fR (resource scope)\fR
1241 .ad
1242 .sp .6
1243 .RS 4n
1244 In the global scope, begin the specification for a given resource type. The
1245 scope is changed to that resource type.
1246 .sp
1247 In the resource scope, add a property of the given name with the given value.
1248 The syntax for property values varies with different property types. In
1249 general, it is a simple value or a list of simple values enclosed in square
1250 brackets, separated by commas (\fB[foo,bar,baz]\fR). See \fBPROPERTIES\fR.
1251 .RE
1253 .sp
1254 .ne 2
1255 .na
1256 \fB\fBcancel\fR\fR
1257 .ad
1258 .sp .6
1259 .RS 4n
1260 End the resource specification and reset scope to global. Abandons any
1261 partially specified resources. \fBcancel\fR is only applicable in the resource
1262 scope.
1263 .RE
1265 .sp
1266 .ne 2
1267 .na
1268 \fB\fBclear\fR \fIproperty-name\fR\fR
1269 .ad
1270 .sp .6
1271 .RS 4n
1272 Clear the value for the property.
1273 .RE
1275 .sp
1276 .ne 2
1277 .na
1278 \fB\fBcommit\fR\fR
1279 .ad
1280 .sp .6
1281 .RS 4n
1282 Commit the current configuration from memory to stable storage. The
1283 configuration must be committed to be used by \fBzoneadm\fR. Until the
1284 in-memory configuration is committed, you can remove changes with the
1285 \fBrevert\fR subcommand. The \fBcommit\fR operation is attempted automatically
1286 upon completion of a \fBzonecfg\fR session. Since a configuration must be
1287 correct to be committed, this operation automatically does a verify.
1288 .RE
1290 .sp
1291 .ne 2
1292 .na
1293 \fB\fBcreate [\fR\fB-F\fR\fB] [\fR \fB-a\fR \fIpath\fR |\fB-b\fR \fB|\fR
1294 \fB-t\fR \fItemplate\fR\fB]\fR\fR
1295 .ad
1296 .sp .6
1297 .RS 4n
1298 Create an in-memory configuration for the specified zone. Use \fBcreate\fR to
1299 begin to configure a new zone. See \fBcommit\fR for saving this to stable
1300 storage.
1301 .sp
1302 If you are overwriting an existing configuration, specify the \fB-F\fR option
1303 to force the action. Specify the \fB-t\fR \fItemplate\fR option to create a
1304 configuration identical to \fItemplate\fR, where \fItemplate\fR is the name of
1305 a configured zone.
1306 .sp
1307 Use the \fB-a\fR \fIpath\fR option to facilitate configuring a detached zone on
1308 a new host. The \fIpath\fR parameter is the zonepath location of a detached
1309 zone that has been moved on to this new host. Once the detached zone is
1310 configured, it should be installed using the "\fBzoneadm attach\fR" command
1311 (see \fBzoneadm\fR(8)). All validation of the new zone happens during the
1312 \fBattach\fR process, not during zone configuration.
1313 .sp
1314 Use the \fB-b\fR option to create a blank configuration. Without arguments,
1315 \fBcreate\fR applies the Sun default settings.
1316 .RE
1318 .sp
1319 .ne 2
1320 .na
1321 \fB\fBdelete [\fR\fB-F\fR\fB]\fR\fR
1322 .ad
1323 .sp .6
1324 .RS 4n
1325 Delete the specified configuration from memory and stable storage. This action
1326 is instantaneous, no commit is necessary. A deleted configuration cannot be
1327 reverted.
1328 .sp
1329 Specify the \fB-F\fR option to force the action.
1330 .RE
1332 .sp
1333 .ne 2
1334 .na
1335 \fB\fBend\fR\fR
1336 .ad
1337 .sp .6
1338 .RS 4n
1339 End the resource specification. This subcommand is only applicable in the
1340 resource scope. \fBzonecfg\fR checks to make sure the current resource is
1341 completely specified. If so, it is added to the in-memory configuration (see
1342 \fBcommit\fR for saving this to stable storage) and the scope reverts to
1343 global. If the specification is incomplete, it issues an appropriate error
1344 message.
1345 .RE
1347 .sp
1348 .ne 2
1349 .na
1350 \fB\fBexport [\fR\fB-f\fR \fIoutput-file\fR\fB]\fR\fR
1351 .ad
1352 .sp .6
1353 .RS 4n
1354 Print configuration to standard output. Use the \fB-f\fR option to print the
1355 configuration to \fIoutput-file\fR. This option produces output in a form
1356 suitable for use in a command file.
1357 .RE
1359 .sp
1360 .ne 2
1361 .na
1362 \fB\fBhelp [usage] [\fIsubcommand\fR] [syntax] [\fR\fIcommand-name\fR\fB]\fR\fR
1363 .ad
1364 .sp .6
1365 .RS 4n
1366 Print general help or help about given topic.
1367 .RE
1369 .sp
1370 .ne 2
1371 .na
1372 \fB\fBinfo zonename | zonepath | autoboot | brand | pool | limitpriv\fR\fR
1373 .ad
1374 .br
1375 .na
1376 \fB\fBinfo [\fR\fIresource-type\fR
1377 \fB[\fR\fIproperty-name\fR\fB=\fR\fIproperty-value\fR\fB]*]\fR\fR
1378 .ad
1379 .sp .6
1380 .RS 4n
1381 Display information about the current configuration. If \fIresource-type\fR is
1382 specified, displays only information about resources of the relevant type. If
1383 any \fIproperty-name\fR value pairs are specified, displays only information
1384 about resources meeting the given criteria. In the resource scope, any
1385 arguments are ignored, and \fBinfo\fR displays information about the resource
1386 which is currently being added or modified.
1387 .RE
1389 .sp
1390 .ne 2
1391 .na
1392 \fB\fBremove\fR \fIresource-type\fR\fB{\fR\fIproperty-name\fR\fB=\fR\fIproperty
1393 -value\fR\fB}\fR(global scope)\fR
1394 .ad
1395 .sp .6
1396 .RS 4n
1397 In the global scope, removes the specified resource. The \fB[]\fR syntax means
1398 0 or more of whatever is inside the square braces. If you want only to remove a
1399 single instance of the resource, you must specify enough property name-value
1400 pairs for the resource to be uniquely identified. If no property name-value
1401 pairs are specified, all instances will be removed. If there is more than one
1402 pair is specified, a confirmation is required, unless you use the \fB-F\fR
1403 option.
1404 .RE
1406 .sp
1407 .ne 2
1408 .na
1409 \fB\fBselect\fR \fIresource-type\fR
1410 \fB{\fR\fIproperty-name\fR\fB=\fR\fIproperty-value\fR\fB}\fR\fR
1411 .ad
1412 .sp .6
1413 .RS 4n
1414 Select the resource of the given type which matches the given
1415 \fIproperty-name\fR \fIproperty-value\fR pair criteria, for modification. This
1416 subcommand is applicable only in the global scope. The scope is changed to that
1417 resource type. The \fB{}\fR syntax means 1 or more of whatever is inside the
1418 curly braces. You must specify enough \fIproperty -name property-value\fR pairs
1419 for the resource to be uniquely identified.
1420 .RE
1422 .sp
1423 .ne 2
1424 .na
1425 \fB\fBset\fR \fIproperty-name\fR\fB=\fR\fIproperty\fR\fB-\fR\fIvalue\fR\fR
1426 .ad
1427 .sp .6
1428 .RS 4n
1429 Set a given property name to the given value. Some properties (for example,
1430 \fBzonename\fR and \fBzonepath\fR) are global while others are
1431 resource-specific. This subcommand is applicable in both the global and
1432 resource scopes.
1433 .RE
1435 .sp
1436 .ne 2
1437 .na
1438 \fB\fBverify\fR\fR
1439 .ad
1440 .sp .6
1441 .RS 4n
1442 Verify the current configuration for correctness:
1443 .RS +4
1444 .TP
1445 .ie t \(bu
1446 .el o
1447 All resources have all of their required properties specified.
1448 .RE
1449 .RS +4
1450 .TP
1451 .ie t \(bu
1452 .el o
1453 A \fBzonepath\fR is specified.
1454 .RE
1455 .RE
1457 .sp
1458 .ne 2
1459 .na
1460 \fB\fBrevert\fR \fB[\fR\fB-F\fR\fB]\fR\fR
1461 .ad
1462 .sp .6
1463 .RS 4n
1464 Revert the configuration back to the last committed state. The \fB-F\fR option
1465 can be used to force the action.
1466 .RE
1468 .sp
1469 .ne 2
1470 .na
1471 \fB\fBexit [\fR\fB-F\fR\fB]\fR\fR
1472 .ad
1473 .sp .6
1474 .RS 4n
1475 Exit the \fBzonecfg\fR session. A commit is automatically attempted if needed.
1476 You can also use an \fBEOF\fR character to exit \fBzonecfg\fR. The \fB-F\fR
1477 option can be used to force the action.
1478 .RE
1480 .SH EXAMPLES
1481 .LP
1482 \fBExample 1 \fRCreating the Environment for a New Zone
1483 .sp
1484 .LP
1485 In the following example, \fBzonecfg\fR creates the environment for a new zone.
1486 \fB/usr/local\fR is loopback mounted from the global zone into
1487 \fB/opt/local\fR. \fB/opt/sfw\fR is loopback mounted from the global zone,
1488 three logical network interfaces are added, and a limit on the number of
1489 fair-share scheduler (FSS) CPU shares for a zone is set using the \fBrctl\fR
1490 resource type. The example also shows how to select a given resource for
1491 modification.
1493 .sp
1494 .in +2
1495 .nf
1496 example# \fBzonecfg -z myzone3\fR
1497 my-zone3: No such zone configured
1498 Use 'create' to begin configuring a new zone.
1499 zonecfg:myzone3> \fBcreate\fR
1500 zonecfg:myzone3> \fBset zonepath=/export/home/my-zone3\fR
1501 zonecfg:myzone3> \fBset autoboot=true\fR
1502 zonecfg:myzone3> \fBadd fs\fR
1503 zonecfg:myzone3:fs> \fBset dir=/usr/local\fR
1504 zonecfg:myzone3:fs> \fBset special=/opt/local\fR
1505 zonecfg:myzone3:fs> \fBset type=lofs\fR
1506 zonecfg:myzone3:fs> \fBadd options [ro,nodevices]\fR
1507 zonecfg:myzone3:fs> \fBend\fR
1508 zonecfg:myzone3> \fBadd fs\fR
1509 zonecfg:myzone3:fs> \fBset dir=/mnt\fR
1510 zonecfg:myzone3:fs> \fBset special=/dev/dsk/c0t0d0s7\fR
1511 zonecfg:myzone3:fs> \fBset raw=/dev/rdsk/c0t0d0s7\fR
1512 zonecfg:myzone3:fs> \fBset type=ufs\fR
1513 zonecfg:myzone3:fs> \fBend\fR
1514 zonecfg:myzone3> \fBadd net\fR
1515 zonecfg:myzone3:net> \fBset address=192.168.0.1/24\fR
1516 zonecfg:myzone3:net> \fBset physical=eri0\fR
1517 zonecfg:myzone3:net> \fBend\fR
1518 zonecfg:myzone3> \fBadd net\fR
1519 zonecfg:myzone3:net> \fBset address=192.168.1.2/24\fR
1520 zonecfg:myzone3:net> \fBset physical=eri0\fR
1521 zonecfg:myzone3:net> \fBend\fR
1522 zonecfg:myzone3> \fBadd net\fR
1523 zonecfg:myzone3:net> \fBset address=192.168.2.3/24\fR
1524 zonecfg:myzone3:net> \fBset physical=eri0\fR
1525 zonecfg:myzone3:net> \fBend\fR
1526 zonecfg:my-zone3> \fBset cpu-shares=5\fR
1527 zonecfg:my-zone3> \fBadd capped-memory\fR
1528 zonecfg:my-zone3:capped-memory> \fBset physical=50m\fR
1529 zonecfg:my-zone3:capped-memory> \fBset swap=100m\fR
1530 zonecfg:my-zone3:capped-memory> \fBend\fR
1531 zonecfg:myzone3> \fBexit\fR
1532 .fi
1533 .in -2
1534 .sp
1536 .LP
1537 \fBExample 2 \fRCreating a Non-Native Zone
1538 .sp
1539 .LP
1540 The following example creates a new Linux zone:
1542 .sp
1543 .in +2
1544 .nf
1545 example# \fBzonecfg -z lxzone\fR
1546 lxzone: No such zone configured
1547 Use 'create' to begin configuring a new zone
1548 zonecfg:lxzone> \fBcreate -t SUNWlx\fR
1549 zonecfg:lxzone> \fBset zonepath=/export/zones/lxzone\fR
1550 zonecfg:lxzone> \fBset autoboot=true\fR
1551 zonecfg:lxzone> \fBexit\fR
1552 .fi
1553 .in -2
1554 .sp
1556 .LP
1557 \fBExample 3 \fRCreating an Exclusive-IP Zone
1558 .sp
1559 .LP
1560 The following example creates a zone that is granted exclusive access to
1561 \fBbge1\fR and \fBbge33000\fR and that is isolated at the IP layer from the
1562 other zones configured on the system.
1564 .sp
1565 .LP
1566 The IP addresses and routing should be configured inside the new zone using
1567 the normal networking administration tools such as \fBipadm\fR(8).
1569 .sp
1570 .in +2
1571 .nf
1572 example# \fBzonecfg -z excl\fR
1573 excl: No such zone configured
1574 Use 'create' to begin configuring a new zone
1575 zonecfg:excl> \fBcreate\fR
1576 zonecfg:excl> \fBset zonepath=/export/zones/excl\fR
1577 zonecfg:excl> \fBset ip-type=exclusive\fR
1578 zonecfg:excl> \fBadd net\fR
1579 zonecfg:excl:net> \fBset physical=bge1\fR
1580 zonecfg:excl:net> \fBend\fR
1581 zonecfg:excl> \fBadd net\fR
1582 zonecfg:excl:net> \fBset physical=bge33000\fR
1583 zonecfg:excl:net> \fBend\fR
1584 zonecfg:excl> \fBexit\fR
1585 .fi
1586 .in -2
1587 .sp
1589 .LP
1590 \fBExample 4 \fRAssociating a Zone with a Resource Pool
1591 .sp
1592 .LP
1593 The following example shows how to associate an existing zone with an existing
1594 resource pool:
1596 .sp
1597 .in +2
1598 .nf
1599 example# \fBzonecfg -z myzone\fR
1600 zonecfg:myzone> \fBset pool=mypool\fR
1601 zonecfg:myzone> \fBexit\fR
1602 .fi
1603 .in -2
1604 .sp
1606 .sp
1607 .LP
1608 For more information about resource pools, see \fBpooladm\fR(8) and
1609 \fBpoolcfg\fR(8).
1611 .LP
1612 \fBExample 5 \fRChanging the Name of a Zone
1613 .sp
1614 .LP
1615 The following example shows how to change the name of an existing zone:
1617 .sp
1618 .in +2
1619 .nf
1620 example# \fBzonecfg -z myzone\fR
1621 zonecfg:myzone> \fBset zonename=myzone2\fR
1622 zonecfg:myzone2> \fBexit\fR
1623 .fi
1624 .in -2
1625 .sp
1627 .LP
1628 \fBExample 6 \fRChanging the Privilege Set of a Zone
1629 .sp
1630 .LP
1631 The following example shows how to change the set of privileges an existing
1632 zone's processes will be limited to the next time the zone is booted. In this
1633 particular case, the privilege set will be the standard safe set of privileges
1634 a zone normally has along with the privilege to change the system date and
1635 time:
1637 .sp
1638 .in +2
1639 .nf
1640 example# \fBzonecfg -z myzone\fR
1641 zonecfg:myzone> \fBset limitpriv="default,sys_time"\fR
1642 zonecfg:myzone2> \fBexit\fR
1643 .fi
1644 .in -2
1645 .sp
1647 .LP
1648 \fBExample 7 \fRSetting the \fBzone.cpu-shares\fR Property for the Global Zone
1649 .sp
1650 .LP
1651 The following command sets the \fBzone.cpu-shares\fR property for the global
1652 zone:
1654 .sp
1655 .in +2
1656 .nf
1657 example# \fBzonecfg -z global\fR
1658 zonecfg:global> \fBset cpu-shares=5\fR
1659 zonecfg:global> \fBexit\fR
1660 .fi
1661 .in -2
1662 .sp
1664 .LP
1665 \fBExample 8 \fRUsing Pattern Matching
1666 .sp
1667 .LP
1668 The following commands illustrate \fBzonecfg\fR support for pattern matching.
1669 In the zone \fBflexlm\fR, enter:
1671 .sp
1672 .in +2
1673 .nf
1674 zonecfg:flexlm> \fBadd device\fR
1675 zonecfg:flexlm:device> \fBset match="/dev/cua/a00[2-5]"\fR
1676 zonecfg:flexlm:device> \fBend\fR
1677 .fi
1678 .in -2
1679 .sp
1681 .sp
1682 .LP
1683 In the global zone, enter:
1685 .sp
1686 .in +2
1687 .nf
1688 global# \fBls /dev/cua\fR
1689 a a000 a001 a002 a003 a004 a005 a006 a007 b
1690 .fi
1691 .in -2
1692 .sp
1694 .sp
1695 .LP
1696 In the zone \fBflexlm\fR, enter:
1698 .sp
1699 .in +2
1700 .nf
1701 flexlm# \fBls /dev/cua\fR
1702 a002 a003 a004 a005
1703 .fi
1704 .in -2
1705 .sp
1707 .LP
1708 \fBExample 9 \fRSetting a Cap for a Zone to Three CPUs
1709 .sp
1710 .LP
1711 The following sequence uses the \fBzonecfg\fR command to set the CPU cap for a
1712 zone to three CPUs.
1714 .sp
1715 .in +2
1716 .nf
1717 zonecfg:myzone> \fBadd capped-cpu\fR
1718 zonecfg:myzone>capped-cpu> \fBset ncpus=3\fR
1719 zonecfg:myzone>capped-cpu>capped-cpu> \fBend\fR
1720 .fi
1721 .in -2
1722 .sp
1724 .sp
1725 .LP
1726 The preceding sequence, which uses the capped-cpu property, is equivalent to
1727 the following sequence, which makes use of the \fBzone.cpu-cap\fR resource
1728 control.
1730 .sp
1731 .in +2
1732 .nf
1733 zonecfg:myzone> \fBadd rctl\fR
1734 zonecfg:myzone:rctl> \fBset name=zone.cpu-cap\fR
1735 zonecfg:myzone:rctl> \fBadd value (priv=privileged,limit=300,action=none)\fR
1736 zonecfg:myzone:rctl> \fBend\fR
1737 .fi
1738 .in -2
1739 .sp
1741 .LP
1742 \fBExample 10 \fRUsing \fBkstat\fR to Monitor CPU Caps
1743 .sp
1744 .LP
1745 The following command displays information about all CPU caps.
1747 .sp
1748 .in +2
1749 .nf
1750 # \fBkstat -n /cpucaps/\fR
1751 module: caps instance: 0
1752 name: cpucaps_project_0 class: project_caps
1753 above_sec 0
1754 below_sec 2157
1755 crtime 821.048183159
1756 maxusage 2
1757 nwait 0
1758 snaptime 235885.637253027
1759 usage 0
1760 value 18446743151372347932
1761 zonename global
1763 module: caps instance: 0
1764 name: cpucaps_project_1 class: project_caps
1765 above_sec 0
1766 below_sec 0
1767 crtime 225339.192787265
1768 maxusage 5
1769 nwait 0
1770 snaptime 235885.637591677
1771 usage 5
1772 value 18446743151372347932
1773 zonename global
1775 module: caps instance: 0
1776 name: cpucaps_project_201 class: project_caps
1777 above_sec 0
1778 below_sec 235105
1779 crtime 780.37961782
1780 maxusage 100
1781 nwait 0
1782 snaptime 235885.637789687
1783 usage 43
1784 value 100
1785 zonename global
1787 module: caps instance: 0
1788 name: cpucaps_project_202 class: project_caps
1789 above_sec 0
1790 below_sec 235094
1791 crtime 791.72983782
1792 maxusage 100
1793 nwait 0
1794 snaptime 235885.637967512
1795 usage 48
1796 value 100
1797 zonename global
1799 module: caps instance: 0
1800 name: cpucaps_project_203 class: project_caps
1801 above_sec 0
1802 below_sec 235034
1803 crtime 852.104401481
1804 maxusage 75
1805 nwait 0
1806 snaptime 235885.638144304
1807 usage 47
1808 value 100
1809 zonename global
1811 module: caps instance: 0
1812 name: cpucaps_project_86710 class: project_caps
1813 above_sec 22
1814 below_sec 235166
1815 crtime 698.441717859
1816 maxusage 101
1817 nwait 0
1818 snaptime 235885.638319871
1819 usage 54
1820 value 100
1821 zonename global
1823 module: caps instance: 0
1824 name: cpucaps_zone_0 class: zone_caps
1825 above_sec 100733
1826 below_sec 134332
1827 crtime 821.048177123
1828 maxusage 207
1829 nwait 2
1830 snaptime 235885.638497731
1831 usage 199
1832 value 200
1833 zonename global
1835 module: caps instance: 1
1836 name: cpucaps_project_0 class: project_caps
1837 above_sec 0
1838 below_sec 0
1839 crtime 225360.256448422
1840 maxusage 7
1841 nwait 0
1842 snaptime 235885.638714404
1843 usage 7
1844 value 18446743151372347932
1845 zonename test_001
1847 module: caps instance: 1
1848 name: cpucaps_zone_1 class: zone_caps
1849 above_sec 2
1850 below_sec 10524
1851 crtime 225360.256440278
1852 maxusage 106
1853 nwait 0
1854 snaptime 235885.638896443
1855 usage 7
1856 value 100
1857 zonename test_001
1858 .fi
1859 .in -2
1860 .sp
1862 .LP
1863 \fBExample 11 \fRDisplaying CPU Caps for a Specific Zone or Project
1864 .sp
1865 .LP
1866 Using the \fBkstat\fR \fB-c\fR and \fB-i\fR options, you can display CPU caps
1867 for a specific zone or project, as below. The first command produces a display
1868 for a specific project, the second for the same project within zone 1.
1870 .sp
1871 .in +2
1872 .nf
1873 # \fBkstat -c project_caps\fR
1875 # \fBkstat -c project_caps -i 1\fR
1876 .fi
1877 .in -2
1878 .sp
1880 .SH EXIT STATUS
1881 .LP
1882 The following exit values are returned:
1883 .sp
1884 .ne 2
1885 .na
1886 \fB\fB0\fR\fR
1887 .ad
1888 .sp .6
1889 .RS 4n
1890 Successful completion.
1891 .RE
1893 .sp
1894 .ne 2
1895 .na
1896 \fB\fB1\fR\fR
1897 .ad
1898 .sp .6
1899 .RS 4n
1900 An error occurred.
1901 .RE
1903 .sp
1904 .ne 2
1905 .na
1906 \fB\fB2\fR\fR
1907 .ad
1908 .sp .6
1909 .RS 4n
1910 Invalid usage.
1911 .RE
1913 .SH ATTRIBUTES
1914 .LP
1915 See \fBattributes\fR(5) for descriptions of the following attributes:
1916 .sp
1918 .sp
1919 .TS
1920 box;
1921 c | c
1922 l | l .
1923 ATTRIBUTE TYPE ATTRIBUTE VALUE
1924 _
1925 Interface Stability Volatile
1926 .TE
1928 .SH SEE ALSO
1929 .LP
1930 \fBppriv\fR(1), \fBprctl\fR(1), \fBzlogin\fR(1), \fBkstat\fR(8),
1931 \fBmount\fR(8), \fBpooladm\fR(8), \fBpoolcfg\fR(8), \fBpoold\fR(8),
1932 \fBrcapd\fR(8), \fBrctladm\fR(8), \fBsvcadm\fR(8), \fBipadm\fR(8),
1933 \fBzfs\fR(8), \fBzoneadm\fR(8), \fBpriv_str_to_set\fR(3C),
1934 \fBkstat\fR(3KSTAT), \fBvfstab\fR(4), \fBattributes\fR(5), \fBbrands\fR(5),
1935 \fBfnmatch\fR(5), \fBlx\fR(5), \fBprivileges\fR(5), \fBresource_controls\fR(5),
1936 \fBsecurity-flags\fR(5), \fBzones\fR(5)
1937 .sp
1938 .LP
1939 \fISystem Administration Guide: Solaris Containers-Resource Management, and
1940 Solaris Zones\fR
1941 .SH NOTES
1942 .LP
1943 All character data used by \fBzonecfg\fR must be in US-ASCII encoding.