| blob | 97a5b7de11f2526dc95f39c34b0cec909d41cd82 |
1 '\" te
2 .\" Copyright (c) 2004, 2009 Sun Microsystems, Inc. All Rights Reserved.
3 .\" Copyright 2013 Joyent, Inc. All Rights Reserved.
4 .\" Copyright 2017 Peter Tribble
5 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
6 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
7 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
8 .TH ZONECFG 8 "Jul 24, 2017"
9 .SH NAME
10 zonecfg \- set up zone configuration
11 .SH SYNOPSIS
12 .LP
13 .nf
14 \fBzonecfg\fR \fB-z\fR \fIzonename\fR
15 .fi
17 .LP
18 .nf
19 \fBzonecfg\fR \fB-z\fR \fIzonename\fR \fIsubcommand\fR
20 .fi
22 .LP
23 .nf
24 \fBzonecfg\fR \fB-z\fR \fIzonename\fR \fB-f\fR \fIcommand_file\fR
25 .fi
27 .LP
28 .nf
29 \fBzonecfg\fR help
30 .fi
32 .SH DESCRIPTION
33 .LP
34 The \fBzonecfg\fR utility creates and modifies the configuration of a zone.
35 Zone configuration consists of a number of resources and properties.
36 .sp
37 .LP
38 To simplify the user interface, \fBzonecfg\fR uses the concept of a scope. The
39 default scope is global.
40 .sp
41 .LP
42 The following synopsis of the \fBzonecfg\fR command is for interactive usage:
43 .sp
44 .in +2
45 .nf
46 zonecfg \fB-z\fR \fIzonename subcommand\fR
47 .fi
48 .in -2
49 .sp
51 .sp
52 .LP
53 Parameters changed through \fBzonecfg\fR do not affect a running zone. The zone
54 must be rebooted for the changes to take effect.
55 .sp
56 .LP
57 In addition to creating and modifying a zone, the \fBzonecfg\fR utility can
58 also be used to persistently specify the resource management settings for the
59 global zone.
60 .sp
61 .LP
62 In the following text, "rctl" is used as an abbreviation for "resource
63 control". See \fBresource_controls\fR(5).
64 .sp
65 .LP
66 Every zone is configured with an associated brand. The brand determines the
67 user-level environment used within the zone, as well as various behaviors for
68 the zone when it is installed, boots, or is shutdown. Once a zone has been
69 installed the brand cannot be changed. The default brand is determined by the
70 installed distribution in the global zone. Some brands do not support all of
71 the \fBzonecfg\fR properties and resources. See the brand-specific man page for
72 more details on each brand. For an overview of brands, see the \fBbrands\fR(5)
73 man page.
74 .SS "Resources"
75 .LP
76 The following resource types are supported:
77 .sp
78 .ne 2
79 .na
80 \fB\fBattr\fR\fR
81 .ad
82 .sp .6
83 .RS 4n
84 Generic attribute.
85 .RE
87 .sp
88 .ne 2
89 .na
90 \fB\fBcapped-cpu\fR\fR
91 .ad
92 .sp .6
93 .RS 4n
94 Limits for CPU usage.
95 .RE
97 .sp
98 .ne 2
99 .na
100 \fB\fBcapped-memory\fR\fR
101 .ad
102 .sp .6
103 .RS 4n
104 Limits for physical, swap, and locked memory.
105 .RE
107 .sp
108 .ne 2
109 .na
110 \fB\fBdataset\fR\fR
111 .ad
112 .sp .6
113 .RS 4n
114 \fBZFS\fR dataset.
115 .RE
117 .sp
118 .ne 2
119 .na
120 \fB\fBdedicated-cpu\fR\fR
121 .ad
122 .sp .6
123 .RS 4n
124 Subset of the system's processors dedicated to this zone while it is running.
125 .RE
127 .sp
128 .ne 2
129 .na
130 \fB\fBdevice\fR\fR
131 .ad
132 .sp .6
133 .RS 4n
134 Device.
135 .RE
137 .sp
138 .ne 2
139 .na
140 \fB\fBfs\fR\fR
141 .ad
142 .sp .6
143 .RS 4n
144 file-system
145 .RE
147 .sp
148 .ne 2
149 .na
150 \fB\fBnet\fR\fR
151 .ad
152 .sp .6
153 .RS 4n
154 Network interface.
155 .RE
157 .sp
158 .ne 2
159 .na
160 \fB\fBrctl\fR\fR
161 .ad
162 .sp .6
163 .RS 4n
164 Resource control.
165 .RE
167 .sp
168 .ne 2
169 .na
170 \fB\fBsecurity-flags\fR\fR
171 .ad
172 .sp .6
173 .RS 4n
174 Process security flag settings.
175 .RE
177 .sp
178 .ne 2
179 .na
180 \fB\fBadmin\fR\fR
181 .ad
182 .sp .6
183 .RS 4n
184 Delegation of administration to specific users.
185 .RE
187 .SS "Properties"
188 .LP
189 Each resource type has one or more properties. There are also some global
190 properties, that is, properties of the configuration as a whole, rather than of
191 some particular resource.
192 .sp
193 .LP
194 The following properties are supported:
195 .sp
196 .ne 2
197 .na
198 \fB(global)\fR
199 .ad
200 .sp .6
201 .RS 4n
202 \fBzonename\fR
203 .RE
205 .sp
206 .ne 2
207 .na
208 \fB(global)\fR
209 .ad
210 .sp .6
211 .RS 4n
212 \fBzonepath\fR
213 .RE
215 .sp
216 .ne 2
217 .na
218 \fB(global)\fR
219 .ad
220 .sp .6
221 .RS 4n
222 \fBautoboot\fR
223 .RE
225 .sp
226 .ne 2
227 .na
228 \fB(global)\fR
229 .ad
230 .sp .6
231 .RS 4n
232 \fBbootargs\fR
233 .RE
235 .sp
236 .ne 2
237 .na
238 \fB(global)\fR
239 .ad
240 .sp .6
241 .RS 4n
242 \fBpool\fR
243 .RE
245 .sp
246 .ne 2
247 .na
248 \fB(global)\fR
249 .ad
250 .sp .6
251 .RS 4n
252 \fBlimitpriv\fR
253 .RE
255 .sp
256 .ne 2
257 .na
258 \fB(global)\fR
259 .ad
260 .sp .6
261 .RS 4n
262 \fBbrand\fR
263 .RE
265 .sp
266 .ne 2
267 .na
268 \fB(global)\fR
269 .ad
270 .sp .6
271 .RS 4n
272 \fBcpu-shares\fR
273 .RE
275 .sp
276 .ne 2
277 .na
278 \fB(global)\fR
279 .ad
280 .sp .6
281 .RS 4n
282 \fBhostid\fR
283 .RE
285 .sp
286 .ne 2
287 .na
288 \fB(global)\fR
289 .ad
290 .sp .6
291 .RS 4n
292 \fBmax-lwps\fR
293 .RE
295 .sp
296 .ne 2
297 .na
298 \fB(global)\fR
299 .ad
300 .sp .6
301 .RS 4n
302 \fBmax-msg-ids\fR
303 .RE
305 .sp
306 .ne 2
307 .na
308 \fB(global)\fR
309 .ad
310 .sp .6
311 .RS 4n
312 \fBmax-sem-ids\fR
313 .RE
315 .sp
316 .ne 2
317 .na
318 \fB(global)\fR
319 .ad
320 .sp .6
321 .RS 4n
322 \fBmax-shm-ids\fR
323 .RE
325 .sp
326 .ne 2
327 .na
328 \fB(global)\fR
329 .ad
330 .sp .6
331 .RS 4n
332 \fBmax-shm-memory\fR
333 .RE
335 .sp
336 .ne 2
337 .na
338 \fB(global)\fR
339 .ad
340 .sp .6
341 .RS 4n
342 \fBscheduling-class\fR
343 .RE
345 .sp
346 .ne 2
347 .na
348 .B (global)
349 .ad
350 .sp .6
351 .RS 4n
352 .B fs-allowed
353 .RE
355 .sp
356 .ne 2
357 .na
358 \fB\fBfs\fR\fR
359 .ad
360 .sp .6
361 .RS 4n
362 \fBdir\fR, \fBspecial\fR, \fBraw\fR, \fBtype\fR, \fBoptions\fR
363 .RE
365 .sp
366 .ne 2
367 .na
368 \fB\fBnet\fR\fR
369 .ad
370 .sp .6
371 .RS 4n
372 \fBaddress\fR, \fBallowed-address\fR, \fBphysical\fR, \fBdefrouter\fR
373 .RE
375 .sp
376 .ne 2
377 .na
378 \fB\fBdevice\fR\fR
379 .ad
380 .sp .6
381 .RS 4n
382 \fBmatch\fR
383 .RE
385 .sp
386 .ne 2
387 .na
388 \fB\fBrctl\fR\fR
389 .ad
390 .sp .6
391 .RS 4n
392 \fBname\fR, \fBvalue\fR
393 .RE
395 .sp
396 .ne 2
397 .na
398 \fB\fBattr\fR\fR
399 .ad
400 .sp .6
401 .RS 4n
402 \fBname\fR, \fBtype\fR, \fBvalue\fR
403 .RE
405 .sp
406 .ne 2
407 .na
408 \fB\fBdataset\fR\fR
409 .ad
410 .sp .6
411 .RS 4n
412 \fBname\fR
413 .RE
415 .sp
416 .ne 2
417 .na
418 \fB\fBdedicated-cpu\fR\fR
419 .ad
420 .sp .6
421 .RS 4n
422 \fBncpus\fR, \fBimportance\fR
423 .RE
425 .sp
426 .ne 2
427 .na
428 \fB\fBcapped-memory\fR\fR
429 .ad
430 .sp .6
431 .RS 4n
432 \fBphysical\fR, \fBswap\fR, \fBlocked\fR
433 .RE
435 .sp
436 .ne 2
437 .na
438 \fB\fBcapped-cpu\fR\fR
439 .ad
440 .sp .6
441 .RS 4n
442 \fBncpus\fR
443 .RE
445 .sp
446 .ne 2
447 .na
448 \fB\fBsecurity-flags\fR\fR
449 .ad
450 .sp .6
451 .RS 4n
452 \fBlower\fR, \fBdefault\fR, \fBupper\fR.
453 .RE
455 .sp
456 .ne 2
457 .na
458 \fB\fBadmin\fR\fR
459 .ad
460 .sp .6
461 .RS 4n
462 \fBuser\fR, \fBauths\fR.
463 .RE
465 .sp
466 .LP
467 As for the property values which are paired with these names, they are either
468 simple, complex, or lists. The type allowed is property-specific. Simple values
469 are strings, optionally enclosed within quotation marks. Complex values have
470 the syntax:
471 .sp
472 .in +2
473 .nf
474 (<\fIname\fR>=<\fIvalue\fR>,<\fIname\fR>=<\fIvalue\fR>,...)
475 .fi
476 .in -2
477 .sp
479 .sp
480 .LP
481 where each <\fIvalue\fR> is simple, and the <\fIname\fR> strings are unique
482 within a given property. Lists have the syntax:
483 .sp
484 .in +2
485 .nf
486 [<\fIvalue\fR>,...]
487 .fi
488 .in -2
489 .sp
491 .sp
492 .LP
493 where each <\fIvalue\fR> is either simple or complex. A list of a single value
494 (either simple or complex) is equivalent to specifying that value without the
495 list syntax. That is, "foo" is equivalent to "[foo]". A list can be empty
496 (denoted by "[]").
497 .sp
498 .LP
499 In interpreting property values, \fBzonecfg\fR accepts regular expressions as
500 specified in \fBfnmatch\fR(5). See \fBEXAMPLES\fR.
501 .sp
502 .LP
503 The property types are described as follows:
504 .sp
505 .ne 2
506 .na
507 \fBglobal: \fBzonename\fR\fR
508 .ad
509 .sp .6
510 .RS 4n
511 The name of the zone.
512 .RE
514 .sp
515 .ne 2
516 .na
517 \fBglobal: \fBzonepath\fR\fR
518 .ad
519 .sp .6
520 .RS 4n
521 Path to zone's file system.
522 .RE
524 .sp
525 .ne 2
526 .na
527 \fBglobal: \fBautoboot\fR\fR
528 .ad
529 .sp .6
530 .RS 4n
531 Boolean indicating that a zone should be booted automatically at system boot.
532 Note that if the zones service is disabled, the zone will not autoboot,
533 regardless of the setting of this property. You enable the zones service with a
534 \fBsvcadm\fR command, such as:
535 .sp
536 .in +2
537 .nf
538 # \fBsvcadm enable svc:/system/zones:default\fR
539 .fi
540 .in -2
541 .sp
543 Replace \fBenable\fR with \fBdisable\fR to disable the zones service. See
544 \fBsvcadm\fR(8).
545 .RE
547 .sp
548 .ne 2
549 .na
550 \fBglobal: \fBbootargs\fR\fR
551 .ad
552 .sp .6
553 .RS 4n
554 Arguments (options) to be passed to the zone bootup, unless options are
555 supplied to the "\fBzoneadm boot\fR" command, in which case those take
556 precedence. The valid arguments are described in \fBzoneadm\fR(8).
557 .RE
559 .sp
560 .ne 2
561 .na
562 \fBglobal: \fBpool\fR\fR
563 .ad
564 .sp .6
565 .RS 4n
566 Name of the resource pool that this zone must be bound to when booted. This
567 property is incompatible with the \fBdedicated-cpu\fR resource.
568 .RE
570 .sp
571 .ne 2
572 .na
573 \fBglobal: \fBlimitpriv\fR\fR
574 .ad
575 .sp .6
576 .RS 4n
577 The maximum set of privileges any process in this zone can obtain. The property
578 should consist of a comma-separated privilege set specification as described in
579 \fBpriv_str_to_set\fR(3C). Privileges can be excluded from the resulting set by
580 preceding their names with a dash (-) or an exclamation point (!). The special
581 privilege string "zone" is not supported in this context. If the special string
582 "default" occurs as the first token in the property, it expands into a safe set
583 of privileges that preserve the resource and security isolation described in
584 \fBzones\fR(5). A missing or empty property is equivalent to this same set of
585 safe privileges.
586 .sp
587 The system administrator must take extreme care when configuring privileges for
588 a zone. Some privileges cannot be excluded through this mechanism as they are
589 required in order to boot a zone. In addition, there are certain privileges
590 which cannot be given to a zone as doing so would allow processes inside a zone
591 to unduly affect processes in other zones. \fBzoneadm\fR(8) indicates when an
592 invalid privilege has been added or removed from a zone's privilege set when an
593 attempt is made to either "boot" or "ready" the zone.
594 .sp
595 See \fBprivileges\fR(5) for a description of privileges. The command "\fBppriv
596 -l\fR" (see \fBppriv\fR(1)) produces a list of all Solaris privileges. You can
597 specify privileges as they are displayed by \fBppriv\fR. In
598 \fBprivileges\fR(5), privileges are listed in the form
599 PRIV_\fIprivilege_name\fR. For example, the privilege \fIsys_time\fR, as you
600 would specify it in this property, is listed in \fBprivileges\fR(5) as
601 \fBPRIV_SYS_TIME\fR.
602 .RE
604 .sp
605 .ne 2
606 .na
607 \fBglobal: \fBbrand\fR\fR
608 .ad
609 .sp .6
610 .RS 4n
611 The zone's brand type.
612 .RE
614 .sp
615 .ne 2
616 .na
617 \fBglobal: \fBip-type\fR\fR
618 .ad
619 .sp .6
620 .RS 4n
621 A zone can either share the IP instance with the global zone, which is the
622 default, or have its own exclusive instance of IP.
623 .sp
624 This property takes the values \fBshared\fR and \fBexclusive\fR.
625 .RE
627 .sp
628 .ne 2
629 .na
630 \fBglobal: \fBhostid\fR\fR
631 .ad
632 .sp .6
633 .RS 4n
634 A zone can emulate a 32-bit host identifier to ease system consolidation. A
635 zone's \fBhostid\fR property is empty by default, meaning that the zone does
636 not emulate a host identifier. Zone host identifiers must be hexadecimal values
637 between 0 and FFFFFFFE. A \fB0x\fR or \fB0X\fR prefix is optional. Both
638 uppercase and lowercase hexadecimal digits are acceptable.
639 .RE
641 .sp
642 .ne 2
643 .na
644 \fB\fBfs\fR: dir, special, raw, type, options\fR
645 .ad
646 .sp .6
647 .RS 4n
648 Values needed to determine how, where, and so forth to mount file systems. See
649 \fBmount\fR(8), \fBmount\fR(2), \fBfsck\fR(8), and \fBvfstab\fR(4).
650 .RE
652 .sp
653 .ne 2
654 .na
655 \fB\fBnet\fR: address, allowed-address, physical, defrouter\fR
656 .ad
657 .sp .6
658 .RS 4n
659 The network address and physical interface name of the network interface. The
660 network address is one of:
661 .RS +4
662 .TP
663 .ie t \(bu
664 .el o
665 a valid IPv4 address, optionally followed by "\fB/\fR" and a prefix length;
666 .RE
667 .RS +4
668 .TP
669 .ie t \(bu
670 .el o
671 a valid IPv6 address, which must be followed by "\fB/\fR" and a prefix length;
672 .RE
673 .RS +4
674 .TP
675 .ie t \(bu
676 .el o
677 a host name which resolves to an IPv4 address.
678 .RE
679 Note that host names that resolve to IPv6 addresses are not supported.
680 .sp
681 The physical interface name is the network interface name.
682 .sp
683 The default router is specified similarly to the network address except that it
684 must not be followed by a \fB/\fR (slash) and a network prefix length.
685 .sp
686 A zone can be configured to be either exclusive-IP or shared-IP. For a
687 shared-IP zone, you must set both the physical and address properties; setting
688 the default router is optional. The interface specified in the physical
689 property must be plumbed in the global zone prior to booting the non-global
690 zone. However, if the interface is not used by the global zone, it should be
691 configured \fBdown\fR in the global zone, and the default router for the
692 interface should be specified here.
693 .sp
694 For an exclusive-IP zone, the physical property must be set and the address and
695 default router properties cannot be set.
696 .sp
697 An exclusive-IP zone is responsible for managing its own network configuration.
698 If the allowed-address property is set, the zone administrator will only be
699 permitted to configure the interface with the specified address. To allow
700 multiple addresses (for example, an IPv4 and IPv6 address), use add net
701 multiple times.
702 .RE
704 .sp
705 .ne 2
706 .na
707 \fB\fBdevice\fR: match\fR
708 .ad
709 .sp .6
710 .RS 4n
711 Device name to match.
712 .RE
714 .sp
715 .ne 2
716 .na
717 \fB\fBrctl\fR: name, value\fR
718 .ad
719 .sp .6
720 .RS 4n
721 The name and \fIpriv\fR/\fIlimit\fR/\fIaction\fR triple of a resource control.
722 See \fBprctl\fR(1) and \fBrctladm\fR(8). The preferred way to set rctl values
723 is to use the global property name associated with a specific rctl.
724 .RE
726 .sp
727 .ne 2
728 .na
729 \fB\fBattr\fR: name, type, value\fR
730 .ad
731 .sp .6
732 .RS 4n
733 The name, type and value of a generic attribute. The \fBtype\fR must be one of
734 \fBint\fR, \fBuint\fR, \fBboolean\fR or \fBstring\fR, and the value must be of
735 that type. \fBuint\fR means unsigned, that is, a non-negative integer.
736 .RE
738 .sp
739 .ne 2
740 .na
741 \fB\fBdataset\fR: name\fR
742 .ad
743 .sp .6
744 .RS 4n
745 The name of a \fBZFS\fR dataset to be accessed from within the zone. See
746 \fBzfs\fR(8).
747 .RE
749 .sp
750 .ne 2
751 .na
752 \fBglobal: \fBcpu-shares\fR\fR
753 .ad
754 .sp .6
755 .RS 4n
756 The number of Fair Share Scheduler (FSS) shares to allocate to this zone. This
757 property is incompatible with the \fBdedicated-cpu\fR resource. This property
758 is the preferred way to set the \fBzone.cpu-shares\fR rctl.
759 .RE
761 .sp
762 .ne 2
763 .na
764 \fBglobal: \fBmax-lwps\fR\fR
765 .ad
766 .sp .6
767 .RS 4n
768 The maximum number of LWPs simultaneously available to this zone. This property
769 is the preferred way to set the \fBzone.max-lwps\fR rctl.
770 .RE
772 .sp
773 .ne 2
774 .na
775 \fBglobal: \fBmax-msg-ids\fR\fR
776 .ad
777 .sp .6
778 .RS 4n
779 The maximum number of message queue IDs allowed for this zone. This property is
780 the preferred way to set the \fBzone.max-msg-ids\fR rctl.
781 .RE
783 .sp
784 .ne 2
785 .na
786 \fBglobal: \fBmax-sem-ids\fR\fR
787 .ad
788 .sp .6
789 .RS 4n
790 The maximum number of semaphore IDs allowed for this zone. This property is the
791 preferred way to set the \fBzone.max-sem-ids\fR rctl.
792 .RE
794 .sp
795 .ne 2
796 .na
797 \fBglobal: \fBmax-shm-ids\fR\fR
798 .ad
799 .sp .6
800 .RS 4n
801 The maximum number of shared memory IDs allowed for this zone. This property is
802 the preferred way to set the \fBzone.max-shm-ids\fR rctl.
803 .RE
805 .sp
806 .ne 2
807 .na
808 \fBglobal: \fBmax-shm-memory\fR\fR
809 .ad
810 .sp .6
811 .RS 4n
812 The maximum amount of shared memory allowed for this zone. This property is the
813 preferred way to set the \fBzone.max-shm-memory\fR rctl. A scale (K, M, G, T)
814 can be applied to the value for this number (for example, 8 is one megabyte).
815 .RE
817 .sp
818 .ne 2
819 .na
820 \fBglobal: \fBscheduling-class\fR\fR
821 .ad
822 .sp .6
823 .RS 4n
824 Specifies the scheduling class used for processes running in a zone. When this
825 property is not specified, the scheduling class is established as follows:
826 .RS +4
827 .TP
828 .ie t \(bu
829 .el o
830 If the \fBcpu-shares\fR property or equivalent rctl is set, the scheduling
831 class FSS is used.
832 .RE
833 .RS +4
834 .TP
835 .ie t \(bu
836 .el o
837 If neither \fBcpu-shares\fR nor the equivalent rctl is set and the zone's pool
838 property references a pool that has a default scheduling class, that class is
839 used.
840 .RE
841 .RS +4
842 .TP
843 .ie t \(bu
844 .el o
845 Under any other conditions, the system default scheduling class is used.
846 .RE
847 .RE
851 .sp
852 .ne 2
853 .na
854 \fB\fBdedicated-cpu\fR: ncpus, importance\fR
855 .ad
856 .sp .6
857 .RS 4n
858 The number of CPUs that should be assigned for this zone's exclusive use. The
859 zone will create a pool and processor set when it boots. See \fBpooladm\fR(8)
860 and \fBpoolcfg\fR(8) for more information on resource pools. The \fBncpu\fR
861 property can specify a single value or a range (for example, 1-4) of
862 processors. The \fBimportance\fR property is optional; if set, it will specify
863 the \fBpset.importance\fR value for use by \fBpoold\fR(8). If this resource is
864 used, there must be enough free processors to allocate to this zone when it
865 boots or the zone will not boot. The processors assigned to this zone will not
866 be available for the use of the global zone or other zones. This resource is
867 incompatible with both the \fBpool\fR and \fBcpu-shares\fR properties. Only a
868 single instance of this resource can be added to the zone.
869 .RE
871 .sp
872 .ne 2
873 .na
874 \fB\fBcapped-memory\fR: physical, swap, locked\fR
875 .ad
876 .sp .6
877 .RS 4n
878 The caps on the memory that can be used by this zone. A scale (K, M, G, T) can
879 be applied to the value for each of these numbers (for example, 8 is one
880 megabyte). Each of these properties is optional but at least one property must
881 be set when adding this resource. Only a single instance of this resource can
882 be added to the zone. The \fBphysical\fR property sets the \fBmax-rss\fR for
883 this zone. This will be enforced by \fBrcapd\fR(8) running in the global zone.
884 The \fBswap\fR property is the preferred way to set the \fBzone.max-swap\fR
885 rctl. The \fBlocked\fR property is the preferred way to set the
886 \fBzone.max-locked-memory\fR rctl.
887 .RE
889 .sp
890 .ne 2
891 .na
892 \fB\fBcapped-cpu\fR: ncpus\fR
893 .ad
894 .sp .6
895 .RS 4n
896 Sets a limit on the amount of CPU time that can be used by a zone. The unit
897 used translates to the percentage of a single CPU that can be used by all user
898 threads in a zone, expressed as a fraction (for example, \fB\&.75\fR) or a
899 mixed number (whole number and fraction, for example, \fB1.25\fR). An
900 \fBncpu\fR value of \fB1\fR means 100% of a CPU, a value of \fB1.25\fR means
901 125%, \fB\&.75\fR mean 75%, and so forth. When projects within a capped zone
902 have their own caps, the minimum value takes precedence.
903 .sp
904 The \fBcapped-cpu\fR property is an alias for \fBzone.cpu-cap\fR resource
905 control and is related to the \fBzone.cpu-cap\fR resource control. See
906 \fBresource_controls\fR(5).
907 .RE
909 .sp
910 .ne 2
911 .na
912 \fB\fBsecurity-flags\fR: lower, default, upper\fR
913 .ad
914 .sp .6
915 .RS 4n
916 Set the process security flags associated with the zone. The \fBlower\fR and
917 \fBupper\fR fields set the limits, the \fBdefault\fR field is set of flags all
918 zone processes inherit.
919 .RE
921 .sp
922 .ne 2
923 .na
924 \fB\fBadmin\fR: user, auths\fR
925 .ad
926 .sp .6
927 .RS 4n
928 Delegate zone administration to the named user. Valid values for \fBauths\fR
929 are \fBlogin\fR, \fBmanage\fR, and \fBclonefrom\fR. The \fBlogin\fR
930 authorization enables the user to use \fBzlogin\fR(1) to log in to the zone,
931 being prompted for authentication (but not to access the zone console). The
932 \fBmanage\fR authorization enables the user to install, update, boot or halt
933 the zone, to log in using \fBzlogin\fR(1) without authentication, and to access
934 the zone console. The \fBclonefrom\fR authorization allows the user to install
935 a new zone using this zone as a clone source.
936 .RE
938 .sp
939 .ne 2
940 .na
941 \fBglobal: \fBfs-allowed\fR\fR
942 .ad
943 .sp .6
944 .RS 4n
945 A comma-separated list of additional filesystems that may be mounted within
946 the zone; for example "ufs,pcfs". By default, only hsfs(7fs) and network
947 filesystems can be mounted. If the first entry in the list is "-" then
948 that disables all of the default filesystems. If any filesystems are listed
949 after "-" then only those filesystems can be mounted.
951 This property does not apply to filesystems mounted into the zone via "add fs"
952 or "add dataset".
954 WARNING: allowing filesystem mounts other than the default may allow the zone
955 administrator to compromise the system with a malicious filesystem image, and
956 is not supported.
957 .RE
959 .sp
960 .LP
961 The following table summarizes resources, property-names, and types:
962 .sp
963 .in +2
964 .nf
965 resource property-name type
966 (global) zonename simple
967 (global) zonepath simple
968 (global) autoboot simple
969 (global) bootargs simple
970 (global) pool simple
971 (global) limitpriv simple
972 (global) brand simple
973 (global) ip-type simple
974 (global) hostid simple
975 (global) cpu-shares simple
976 (global) max-lwps simple
977 (global) max-msg-ids simple
978 (global) max-sem-ids simple
979 (global) max-shm-ids simple
980 (global) max-shm-memory simple
981 (global) scheduling-class simple
982 fs dir simple
983 special simple
984 raw simple
985 type simple
986 options list of simple
987 net address simple
988 physical simple
989 device match simple
990 rctl name simple
991 value list of complex
992 attr name simple
993 type simple
994 value simple
995 dataset name simple
996 dedicated-cpu ncpus simple or range
997 importance simple
999 capped-memory physical simple with scale
1000 swap simple with scale
1001 locked simple with scale
1003 capped-cpu ncpus simple
1004 security-flags lower simple
1005 default simple
1006 upper simple
1007 admin user simple
1008 auths simple
1009 .fi
1010 .in -2
1011 .sp
1013 .sp
1014 .LP
1015 To further specify things, the breakdown of the complex property "value" of the
1016 "rctl" resource type, it consists of three name/value pairs, the names being
1017 "priv", "limit" and "action", each of which takes a simple value. The "name"
1018 property of an "attr" resource is syntactically restricted in a fashion similar
1019 but not identical to zone names: it must begin with an alphanumeric, and can
1020 contain alphanumerics plus the hyphen (\fB-\fR), underscore (\fB_\fR), and dot
1021 (\fB\&.\fR) characters. Attribute names beginning with "zone" are reserved for
1022 use by the system. Finally, the "autoboot" global property must have a value of
1023 "true" or "false".
1024 .SS "Using Kernel Statistics to Monitor CPU Caps"
1025 .LP
1026 Using the kernel statistics (\fBkstat\fR(3KSTAT)) module \fBcaps\fR, the system
1027 maintains information for all capped projects and zones. You can access this
1028 information by reading kernel statistics (\fBkstat\fR(3KSTAT)), specifying
1029 \fBcaps\fR as the \fBkstat\fR module name. The following command displays
1030 kernel statistics for all active CPU caps:
1031 .sp
1032 .in +2
1033 .nf
1034 # \fBkstat caps::'/cpucaps/'\fR
1035 .fi
1036 .in -2
1037 .sp
1039 .sp
1040 .LP
1041 A \fBkstat\fR(8) command running in a zone displays only CPU caps relevant for
1042 that zone and for projects in that zone. See \fBEXAMPLES\fR.
1043 .sp
1044 .LP
1045 The following are cap-related arguments for use with \fBkstat\fR(8):
1046 .sp
1047 .ne 2
1048 .na
1049 \fB\fBcaps\fR\fR
1050 .ad
1051 .sp .6
1052 .RS 4n
1053 The \fBkstat\fR module.
1054 .RE
1056 .sp
1057 .ne 2
1058 .na
1059 \fB\fBproject_caps\fR or \fBzone_caps\fR\fR
1060 .ad
1061 .sp .6
1062 .RS 4n
1063 \fBkstat\fR class, for use with the \fBkstat\fR \fB-c\fR option.
1064 .RE
1066 .sp
1067 .ne 2
1068 .na
1069 \fB\fBcpucaps_project_\fR\fIid\fR or \fBcpucaps_zone_\fR\fIid\fR\fR
1070 .ad
1071 .sp .6
1072 .RS 4n
1073 \fBkstat\fR name, for use with the \fBkstat\fR \fB-n\fR option. \fIid\fR is the
1074 project or zone identifier.
1075 .RE
1077 .sp
1078 .LP
1079 The following fields are displayed in response to a \fBkstat\fR(8) command
1080 requesting statistics for all CPU caps.
1081 .sp
1082 .ne 2
1083 .na
1084 \fB\fBmodule\fR\fR
1085 .ad
1086 .sp .6
1087 .RS 4n
1088 In this usage of \fBkstat\fR, this field will have the value \fBcaps\fR.
1089 .RE
1091 .sp
1092 .ne 2
1093 .na
1094 \fB\fBname\fR\fR
1095 .ad
1096 .sp .6
1097 .RS 4n
1098 As described above, \fBcpucaps_project_\fR\fIid\fR or
1099 \fBcpucaps_zone_\fR\fIid\fR
1100 .RE
1102 .sp
1103 .ne 2
1104 .na
1105 \fB\fBabove_sec\fR\fR
1106 .ad
1107 .sp .6
1108 .RS 4n
1109 Total time, in seconds, spent above the cap.
1110 .RE
1112 .sp
1113 .ne 2
1114 .na
1115 \fB\fBbelow_sec\fR\fR
1116 .ad
1117 .sp .6
1118 .RS 4n
1119 Total time, in seconds, spent below the cap.
1120 .RE
1122 .sp
1123 .ne 2
1124 .na
1125 \fB\fBmaxusage\fR\fR
1126 .ad
1127 .sp .6
1128 .RS 4n
1129 Maximum observed CPU usage.
1130 .RE
1132 .sp
1133 .ne 2
1134 .na
1135 \fB\fBnwait\fR\fR
1136 .ad
1137 .sp .6
1138 .RS 4n
1139 Number of threads on cap wait queue.
1140 .RE
1142 .sp
1143 .ne 2
1144 .na
1145 \fB\fBusage\fR\fR
1146 .ad
1147 .sp .6
1148 .RS 4n
1149 Current aggregated CPU usage for all threads belonging to a capped project or
1150 zone, in terms of a percentage of a single CPU.
1151 .RE
1153 .sp
1154 .ne 2
1155 .na
1156 \fB\fBvalue\fR\fR
1157 .ad
1158 .sp .6
1159 .RS 4n
1160 The cap value, in terms of a percentage of a single CPU.
1161 .RE
1163 .sp
1164 .ne 2
1165 .na
1166 \fB\fBzonename\fR\fR
1167 .ad
1168 .sp .6
1169 .RS 4n
1170 Name of the zone for which statistics are displayed.
1171 .RE
1173 .sp
1174 .LP
1175 See \fBEXAMPLES\fR for sample output from a \fBkstat\fR command.
1176 .SH OPTIONS
1177 .LP
1178 The following options are supported:
1179 .sp
1180 .ne 2
1181 .na
1182 \fB\fB-f\fR \fIcommand_file\fR\fR
1183 .ad
1184 .sp .6
1185 .RS 4n
1186 Specify the name of \fBzonecfg\fR command file. \fIcommand_file\fR is a text
1187 file of \fBzonecfg\fR subcommands, one per line.
1188 .RE
1190 .sp
1191 .ne 2
1192 .na
1193 \fB\fB-z\fR \fIzonename\fR\fR
1194 .ad
1195 .sp .6
1196 .RS 4n
1197 Specify the name of a zone. Zone names are case sensitive. Zone names must
1198 begin with an alphanumeric character and can contain alphanumeric characters,
1199 the underscore (\fB_\fR) the hyphen (\fB-\fR), and the dot (\fB\&.\fR). The
1200 name \fBglobal\fR and all names beginning with \fBSUNW\fR are reserved and
1201 cannot be used.
1202 .RE
1204 .SH SUBCOMMANDS
1205 .LP
1206 You can use the \fBadd\fR and \fBselect\fR subcommands to select a specific
1207 resource, at which point the scope changes to that resource. The \fBend\fR and
1208 \fBcancel\fR subcommands are used to complete the resource specification, at
1209 which time the scope is reverted back to global. Certain subcommands, such as
1210 \fBadd\fR, \fBremove\fR and \fBset\fR, have different semantics in each scope.
1211 .sp
1212 .LP
1213 \fBzonecfg\fR supports a semicolon-separated list of subcommands. For example:
1214 .sp
1215 .in +2
1216 .nf
1217 # \fBzonecfg -z myzone "add net; set physical=myvnic; end"\fR
1218 .fi
1219 .in -2
1220 .sp
1222 .sp
1223 .LP
1224 Subcommands which can result in destructive actions or loss of work have an
1225 \fB-F\fR option to force the action. If input is from a terminal device, the
1226 user is prompted when appropriate if such a command is given without the
1227 \fB-F\fR option otherwise, if such a command is given without the \fB-F\fR
1228 option, the action is disallowed, with a diagnostic message written to standard
1229 error.
1230 .sp
1231 .LP
1232 The following subcommands are supported:
1233 .sp
1234 .ne 2
1235 .na
1236 \fB\fBadd\fR \fIresource-type\fR (global scope)\fR
1237 .ad
1238 .br
1239 .na
1240 \fB\fBadd\fR \fIproperty-name property-value\fR (resource scope)\fR
1241 .ad
1242 .sp .6
1243 .RS 4n
1244 In the global scope, begin the specification for a given resource type. The
1245 scope is changed to that resource type.
1246 .sp
1247 In the resource scope, add a property of the given name with the given value.
1248 The syntax for property values varies with different property types. In
1249 general, it is a simple value or a list of simple values enclosed in square
1250 brackets, separated by commas (\fB[foo,bar,baz]\fR). See \fBPROPERTIES\fR.
1251 .RE
1253 .sp
1254 .ne 2
1255 .na
1256 \fB\fBcancel\fR\fR
1257 .ad
1258 .sp .6
1259 .RS 4n
1260 End the resource specification and reset scope to global. Abandons any
1261 partially specified resources. \fBcancel\fR is only applicable in the resource
1262 scope.
1263 .RE
1265 .sp
1266 .ne 2
1267 .na
1268 \fB\fBclear\fR \fIproperty-name\fR\fR
1269 .ad
1270 .sp .6
1271 .RS 4n
1272 Clear the value for the property.
1273 .RE
1275 .sp
1276 .ne 2
1277 .na
1278 \fB\fBcommit\fR\fR
1279 .ad
1280 .sp .6
1281 .RS 4n
1282 Commit the current configuration from memory to stable storage. The
1283 configuration must be committed to be used by \fBzoneadm\fR. Until the
1284 in-memory configuration is committed, you can remove changes with the
1285 \fBrevert\fR subcommand. The \fBcommit\fR operation is attempted automatically
1286 upon completion of a \fBzonecfg\fR session. Since a configuration must be
1287 correct to be committed, this operation automatically does a verify.
1288 .RE
1290 .sp
1291 .ne 2
1292 .na
1293 \fB\fBcreate [\fR\fB-F\fR\fB] [\fR \fB-a\fR \fIpath\fR |\fB-b\fR \fB|\fR
1294 \fB-t\fR \fItemplate\fR\fB]\fR\fR
1295 .ad
1296 .sp .6
1297 .RS 4n
1298 Create an in-memory configuration for the specified zone. Use \fBcreate\fR to
1299 begin to configure a new zone. See \fBcommit\fR for saving this to stable
1300 storage.
1301 .sp
1302 If you are overwriting an existing configuration, specify the \fB-F\fR option
1303 to force the action. Specify the \fB-t\fR \fItemplate\fR option to create a
1304 configuration identical to \fItemplate\fR, where \fItemplate\fR is the name of
1305 a configured zone.
1306 .sp
1307 Use the \fB-a\fR \fIpath\fR option to facilitate configuring a detached zone on
1308 a new host. The \fIpath\fR parameter is the zonepath location of a detached
1309 zone that has been moved on to this new host. Once the detached zone is
1310 configured, it should be installed using the "\fBzoneadm attach\fR" command
1311 (see \fBzoneadm\fR(8)). All validation of the new zone happens during the
1312 \fBattach\fR process, not during zone configuration.
1313 .sp
1314 Use the \fB-b\fR option to create a blank configuration. Without arguments,
1315 \fBcreate\fR applies the Sun default settings.
1316 .RE
1318 .sp
1319 .ne 2
1320 .na
1321 \fB\fBdelete [\fR\fB-F\fR\fB]\fR\fR
1322 .ad
1323 .sp .6
1324 .RS 4n
1325 Delete the specified configuration from memory and stable storage. This action
1326 is instantaneous, no commit is necessary. A deleted configuration cannot be
1327 reverted.
1328 .sp
1329 Specify the \fB-F\fR option to force the action.
1330 .RE
1332 .sp
1333 .ne 2
1334 .na
1335 \fB\fBend\fR\fR
1336 .ad
1337 .sp .6
1338 .RS 4n
1339 End the resource specification. This subcommand is only applicable in the
1340 resource scope. \fBzonecfg\fR checks to make sure the current resource is
1341 completely specified. If so, it is added to the in-memory configuration (see
1342 \fBcommit\fR for saving this to stable storage) and the scope reverts to
1343 global. If the specification is incomplete, it issues an appropriate error
1344 message.
1345 .RE
1347 .sp
1348 .ne 2
1349 .na
1350 \fB\fBexport [\fR\fB-f\fR \fIoutput-file\fR\fB]\fR\fR
1351 .ad
1352 .sp .6
1353 .RS 4n
1354 Print configuration to standard output. Use the \fB-f\fR option to print the
1355 configuration to \fIoutput-file\fR. This option produces output in a form
1356 suitable for use in a command file.
1357 .RE
1359 .sp
1360 .ne 2
1361 .na
1362 .BR "help " [ usage ]
1363 .RI [ subcommand ]
1364 [syntax]
1365 .RI [ command-name ]
1366 .ad
1367 .sp .6
1368 .RS 4n
1369 Print general help or help about given topic.
1370 .RE
1372 .sp
1373 .ne 2
1374 .na
1375 \fB\fBinfo zonename | zonepath | autoboot | brand | pool | limitpriv\fR\fR
1376 .ad
1377 .br
1378 .na
1379 \fB\fBinfo [\fR\fIresource-type\fR
1380 \fB[\fR\fIproperty-name\fR\fB=\fR\fIproperty-value\fR\fB]*]\fR\fR
1381 .ad
1382 .sp .6
1383 .RS 4n
1384 Display information about the current configuration. If \fIresource-type\fR is
1385 specified, displays only information about resources of the relevant type. If
1386 any \fIproperty-name\fR value pairs are specified, displays only information
1387 about resources meeting the given criteria. In the resource scope, any
1388 arguments are ignored, and \fBinfo\fR displays information about the resource
1389 which is currently being added or modified.
1390 .RE
1392 .sp
1393 .ne 2
1394 .na
1395 \fB\fBremove\fR \fIresource-type\fR\fB{\fR\fIproperty-name\fR\fB=\fR\fIproperty
1396 -value\fR\fB}\fR(global scope)\fR
1397 .ad
1398 .sp .6
1399 .RS 4n
1400 In the global scope, removes the specified resource. The \fB[]\fR syntax means
1401 0 or more of whatever is inside the square braces. If you want only to remove a
1402 single instance of the resource, you must specify enough property name-value
1403 pairs for the resource to be uniquely identified. If no property name-value
1404 pairs are specified, all instances will be removed. If there is more than one
1405 pair is specified, a confirmation is required, unless you use the \fB-F\fR
1406 option.
1407 .RE
1409 .sp
1410 .ne 2
1411 .na
1412 \fB\fBselect\fR \fIresource-type\fR
1413 \fB{\fR\fIproperty-name\fR\fB=\fR\fIproperty-value\fR\fB}\fR\fR
1414 .ad
1415 .sp .6
1416 .RS 4n
1417 Select the resource of the given type which matches the given
1418 \fIproperty-name\fR \fIproperty-value\fR pair criteria, for modification. This
1419 subcommand is applicable only in the global scope. The scope is changed to that
1420 resource type. The \fB{}\fR syntax means 1 or more of whatever is inside the
1421 curly braces. You must specify enough \fIproperty -name property-value\fR pairs
1422 for the resource to be uniquely identified.
1423 .RE
1425 .sp
1426 .ne 2
1427 .na
1428 \fB\fBset\fR \fIproperty-name\fR\fB=\fR\fIproperty\fR\fB-\fR\fIvalue\fR\fR
1429 .ad
1430 .sp .6
1431 .RS 4n
1432 Set a given property name to the given value. Some properties (for example,
1433 \fBzonename\fR and \fBzonepath\fR) are global while others are
1434 resource-specific. This subcommand is applicable in both the global and
1435 resource scopes.
1436 .RE
1438 .sp
1439 .ne 2
1440 .na
1441 \fB\fBverify\fR\fR
1442 .ad
1443 .sp .6
1444 .RS 4n
1445 Verify the current configuration for correctness:
1446 .RS +4
1447 .TP
1448 .ie t \(bu
1449 .el o
1450 All resources have all of their required properties specified.
1451 .RE
1452 .RS +4
1453 .TP
1454 .ie t \(bu
1455 .el o
1456 A \fBzonepath\fR is specified.
1457 .RE
1458 .RE
1460 .sp
1461 .ne 2
1462 .na
1463 \fB\fBrevert\fR \fB[\fR\fB-F\fR\fB]\fR\fR
1464 .ad
1465 .sp .6
1466 .RS 4n
1467 Revert the configuration back to the last committed state. The \fB-F\fR option
1468 can be used to force the action.
1469 .RE
1471 .sp
1472 .ne 2
1473 .na
1474 \fB\fBexit [\fR\fB-F\fR\fB]\fR\fR
1475 .ad
1476 .sp .6
1477 .RS 4n
1478 Exit the \fBzonecfg\fR session. A commit is automatically attempted if needed.
1479 You can also use an \fBEOF\fR character to exit \fBzonecfg\fR. The \fB-F\fR
1480 option can be used to force the action.
1481 .RE
1483 .SH EXAMPLES
1484 .LP
1485 \fBExample 1 \fRCreating the Environment for a New Zone
1486 .sp
1487 .LP
1488 In the following example, \fBzonecfg\fR creates the environment for a new zone.
1489 \fB/usr/local\fR is loopback mounted from the global zone into
1490 \fB/opt/local\fR. \fB/opt/sfw\fR is loopback mounted from the global zone,
1491 three logical network interfaces are added, and a limit on the number of
1492 fair-share scheduler (FSS) CPU shares for a zone is set using the \fBrctl\fR
1493 resource type. The example also shows how to select a given resource for
1494 modification.
1496 .sp
1497 .in +2
1498 .nf
1499 example# \fBzonecfg -z myzone3\fR
1500 my-zone3: No such zone configured
1501 Use 'create' to begin configuring a new zone.
1502 zonecfg:myzone3> \fBcreate\fR
1503 zonecfg:myzone3> \fBset zonepath=/export/home/my-zone3\fR
1504 zonecfg:myzone3> \fBset autoboot=true\fR
1505 zonecfg:myzone3> \fBadd fs\fR
1506 zonecfg:myzone3:fs> \fBset dir=/usr/local\fR
1507 zonecfg:myzone3:fs> \fBset special=/opt/local\fR
1508 zonecfg:myzone3:fs> \fBset type=lofs\fR
1509 zonecfg:myzone3:fs> \fBadd options [ro,nodevices]\fR
1510 zonecfg:myzone3:fs> \fBend\fR
1511 zonecfg:myzone3> \fBadd fs\fR
1512 zonecfg:myzone3:fs> \fBset dir=/mnt\fR
1513 zonecfg:myzone3:fs> \fBset special=/dev/dsk/c0t0d0s7\fR
1514 zonecfg:myzone3:fs> \fBset raw=/dev/rdsk/c0t0d0s7\fR
1515 zonecfg:myzone3:fs> \fBset type=ufs\fR
1516 zonecfg:myzone3:fs> \fBend\fR
1517 zonecfg:myzone3> \fBadd net\fR
1518 zonecfg:myzone3:net> \fBset address=192.168.0.1/24\fR
1519 zonecfg:myzone3:net> \fBset physical=eri0\fR
1520 zonecfg:myzone3:net> \fBend\fR
1521 zonecfg:myzone3> \fBadd net\fR
1522 zonecfg:myzone3:net> \fBset address=192.168.1.2/24\fR
1523 zonecfg:myzone3:net> \fBset physical=eri0\fR
1524 zonecfg:myzone3:net> \fBend\fR
1525 zonecfg:myzone3> \fBadd net\fR
1526 zonecfg:myzone3:net> \fBset address=192.168.2.3/24\fR
1527 zonecfg:myzone3:net> \fBset physical=eri0\fR
1528 zonecfg:myzone3:net> \fBend\fR
1529 zonecfg:my-zone3> \fBset cpu-shares=5\fR
1530 zonecfg:my-zone3> \fBadd capped-memory\fR
1531 zonecfg:my-zone3:capped-memory> \fBset physical=50m\fR
1532 zonecfg:my-zone3:capped-memory> \fBset swap=100m\fR
1533 zonecfg:my-zone3:capped-memory> \fBend\fR
1534 zonecfg:myzone3> \fBexit\fR
1535 .fi
1536 .in -2
1537 .sp
1539 .LP
1540 \fBExample 2 \fRCreating a Non-Native Zone
1541 .sp
1542 .LP
1543 The following example creates a new Linux zone:
1545 .sp
1546 .in +2
1547 .nf
1548 example# \fBzonecfg -z lxzone\fR
1549 lxzone: No such zone configured
1550 Use 'create' to begin configuring a new zone
1551 zonecfg:lxzone> \fBcreate -t SUNWlx\fR
1552 zonecfg:lxzone> \fBset zonepath=/export/zones/lxzone\fR
1553 zonecfg:lxzone> \fBset autoboot=true\fR
1554 zonecfg:lxzone> \fBexit\fR
1555 .fi
1556 .in -2
1557 .sp
1559 .LP
1560 \fBExample 3 \fRCreating an Exclusive-IP Zone
1561 .sp
1562 .LP
1563 The following example creates a zone that is granted exclusive access to
1564 \fBbge1\fR and \fBbge33000\fR and that is isolated at the IP layer from the
1565 other zones configured on the system.
1567 .sp
1568 .LP
1569 The IP addresses and routing should be configured inside the new zone using
1570 the normal networking administration tools such as \fBipadm\fR(8).
1572 .sp
1573 .in +2
1574 .nf
1575 example# \fBzonecfg -z excl\fR
1576 excl: No such zone configured
1577 Use 'create' to begin configuring a new zone
1578 zonecfg:excl> \fBcreate\fR
1579 zonecfg:excl> \fBset zonepath=/export/zones/excl\fR
1580 zonecfg:excl> \fBset ip-type=exclusive\fR
1581 zonecfg:excl> \fBadd net\fR
1582 zonecfg:excl:net> \fBset physical=bge1\fR
1583 zonecfg:excl:net> \fBend\fR
1584 zonecfg:excl> \fBadd net\fR
1585 zonecfg:excl:net> \fBset physical=bge33000\fR
1586 zonecfg:excl:net> \fBend\fR
1587 zonecfg:excl> \fBexit\fR
1588 .fi
1589 .in -2
1590 .sp
1592 .LP
1593 \fBExample 4 \fRAssociating a Zone with a Resource Pool
1594 .sp
1595 .LP
1596 The following example shows how to associate an existing zone with an existing
1597 resource pool:
1599 .sp
1600 .in +2
1601 .nf
1602 example# \fBzonecfg -z myzone\fR
1603 zonecfg:myzone> \fBset pool=mypool\fR
1604 zonecfg:myzone> \fBexit\fR
1605 .fi
1606 .in -2
1607 .sp
1609 .sp
1610 .LP
1611 For more information about resource pools, see \fBpooladm\fR(8) and
1612 \fBpoolcfg\fR(8).
1614 .LP
1615 \fBExample 5 \fRChanging the Name of a Zone
1616 .sp
1617 .LP
1618 The following example shows how to change the name of an existing zone:
1620 .sp
1621 .in +2
1622 .nf
1623 example# \fBzonecfg -z myzone\fR
1624 zonecfg:myzone> \fBset zonename=myzone2\fR
1625 zonecfg:myzone2> \fBexit\fR
1626 .fi
1627 .in -2
1628 .sp
1630 .LP
1631 \fBExample 6 \fRChanging the Privilege Set of a Zone
1632 .sp
1633 .LP
1634 The following example shows how to change the set of privileges an existing
1635 zone's processes will be limited to the next time the zone is booted. In this
1636 particular case, the privilege set will be the standard safe set of privileges
1637 a zone normally has along with the privilege to change the system date and
1638 time:
1640 .sp
1641 .in +2
1642 .nf
1643 example# \fBzonecfg -z myzone\fR
1644 zonecfg:myzone> \fBset limitpriv="default,sys_time"\fR
1645 zonecfg:myzone2> \fBexit\fR
1646 .fi
1647 .in -2
1648 .sp
1650 .LP
1651 \fBExample 7 \fRSetting the \fBzone.cpu-shares\fR Property for the Global Zone
1652 .sp
1653 .LP
1654 The following command sets the \fBzone.cpu-shares\fR property for the global
1655 zone:
1657 .sp
1658 .in +2
1659 .nf
1660 example# \fBzonecfg -z global\fR
1661 zonecfg:global> \fBset cpu-shares=5\fR
1662 zonecfg:global> \fBexit\fR
1663 .fi
1664 .in -2
1665 .sp
1667 .LP
1668 \fBExample 8 \fRUsing Pattern Matching
1669 .sp
1670 .LP
1671 The following commands illustrate \fBzonecfg\fR support for pattern matching.
1672 In the zone \fBflexlm\fR, enter:
1674 .sp
1675 .in +2
1676 .nf
1677 zonecfg:flexlm> \fBadd device\fR
1678 zonecfg:flexlm:device> \fBset match="/dev/cua/a00[2-5]"\fR
1679 zonecfg:flexlm:device> \fBend\fR
1680 .fi
1681 .in -2
1682 .sp
1684 .sp
1685 .LP
1686 In the global zone, enter:
1688 .sp
1689 .in +2
1690 .nf
1691 global# \fBls /dev/cua\fR
1692 a a000 a001 a002 a003 a004 a005 a006 a007 b
1693 .fi
1694 .in -2
1695 .sp
1697 .sp
1698 .LP
1699 In the zone \fBflexlm\fR, enter:
1701 .sp
1702 .in +2
1703 .nf
1704 flexlm# \fBls /dev/cua\fR
1705 a002 a003 a004 a005
1706 .fi
1707 .in -2
1708 .sp
1710 .LP
1711 \fBExample 9 \fRSetting a Cap for a Zone to Three CPUs
1712 .sp
1713 .LP
1714 The following sequence uses the \fBzonecfg\fR command to set the CPU cap for a
1715 zone to three CPUs.
1717 .sp
1718 .in +2
1719 .nf
1720 zonecfg:myzone> \fBadd capped-cpu\fR
1721 zonecfg:myzone>capped-cpu> \fBset ncpus=3\fR
1722 zonecfg:myzone>capped-cpu>capped-cpu> \fBend\fR
1723 .fi
1724 .in -2
1725 .sp
1727 .sp
1728 .LP
1729 The preceding sequence, which uses the capped-cpu property, is equivalent to
1730 the following sequence, which makes use of the \fBzone.cpu-cap\fR resource
1731 control.
1733 .sp
1734 .in +2
1735 .nf
1736 zonecfg:myzone> \fBadd rctl\fR
1737 zonecfg:myzone:rctl> \fBset name=zone.cpu-cap\fR
1738 zonecfg:myzone:rctl> \fBadd value (priv=privileged,limit=300,action=none)\fR
1739 zonecfg:myzone:rctl> \fBend\fR
1740 .fi
1741 .in -2
1742 .sp
1744 .LP
1745 \fBExample 10 \fRUsing \fBkstat\fR to Monitor CPU Caps
1746 .sp
1747 .LP
1748 The following command displays information about all CPU caps.
1750 .sp
1751 .in +2
1752 .nf
1753 # \fBkstat -n /cpucaps/\fR
1754 module: caps instance: 0
1755 name: cpucaps_project_0 class: project_caps
1756 above_sec 0
1757 below_sec 2157
1758 crtime 821.048183159
1759 maxusage 2
1760 nwait 0
1761 snaptime 235885.637253027
1762 usage 0
1763 value 18446743151372347932
1764 zonename global
1766 module: caps instance: 0
1767 name: cpucaps_project_1 class: project_caps
1768 above_sec 0
1769 below_sec 0
1770 crtime 225339.192787265
1771 maxusage 5
1772 nwait 0
1773 snaptime 235885.637591677
1774 usage 5
1775 value 18446743151372347932
1776 zonename global
1778 module: caps instance: 0
1779 name: cpucaps_project_201 class: project_caps
1780 above_sec 0
1781 below_sec 235105
1782 crtime 780.37961782
1783 maxusage 100
1784 nwait 0
1785 snaptime 235885.637789687
1786 usage 43
1787 value 100
1788 zonename global
1790 module: caps instance: 0
1791 name: cpucaps_project_202 class: project_caps
1792 above_sec 0
1793 below_sec 235094
1794 crtime 791.72983782
1795 maxusage 100
1796 nwait 0
1797 snaptime 235885.637967512
1798 usage 48
1799 value 100
1800 zonename global
1802 module: caps instance: 0
1803 name: cpucaps_project_203 class: project_caps
1804 above_sec 0
1805 below_sec 235034
1806 crtime 852.104401481
1807 maxusage 75
1808 nwait 0
1809 snaptime 235885.638144304
1810 usage 47
1811 value 100
1812 zonename global
1814 module: caps instance: 0
1815 name: cpucaps_project_86710 class: project_caps
1816 above_sec 22
1817 below_sec 235166
1818 crtime 698.441717859
1819 maxusage 101
1820 nwait 0
1821 snaptime 235885.638319871
1822 usage 54
1823 value 100
1824 zonename global
1826 module: caps instance: 0
1827 name: cpucaps_zone_0 class: zone_caps
1828 above_sec 100733
1829 below_sec 134332
1830 crtime 821.048177123
1831 maxusage 207
1832 nwait 2
1833 snaptime 235885.638497731
1834 usage 199
1835 value 200
1836 zonename global
1838 module: caps instance: 1
1839 name: cpucaps_project_0 class: project_caps
1840 above_sec 0
1841 below_sec 0
1842 crtime 225360.256448422
1843 maxusage 7
1844 nwait 0
1845 snaptime 235885.638714404
1846 usage 7
1847 value 18446743151372347932
1848 zonename test_001
1850 module: caps instance: 1
1851 name: cpucaps_zone_1 class: zone_caps
1852 above_sec 2
1853 below_sec 10524
1854 crtime 225360.256440278
1855 maxusage 106
1856 nwait 0
1857 snaptime 235885.638896443
1858 usage 7
1859 value 100
1860 zonename test_001
1861 .fi
1862 .in -2
1863 .sp
1865 .LP
1866 \fBExample 11 \fRDisplaying CPU Caps for a Specific Zone or Project
1867 .sp
1868 .LP
1869 Using the \fBkstat\fR \fB-c\fR and \fB-i\fR options, you can display CPU caps
1870 for a specific zone or project, as below. The first command produces a display
1871 for a specific project, the second for the same project within zone 1.
1873 .sp
1874 .in +2
1875 .nf
1876 # \fBkstat -c project_caps\fR
1878 # \fBkstat -c project_caps -i 1\fR
1879 .fi
1880 .in -2
1881 .sp
1883 .SH EXIT STATUS
1884 .LP
1885 The following exit values are returned:
1886 .sp
1887 .ne 2
1888 .na
1889 \fB\fB0\fR\fR
1890 .ad
1891 .sp .6
1892 .RS 4n
1893 Successful completion.
1894 .RE
1896 .sp
1897 .ne 2
1898 .na
1899 \fB\fB1\fR\fR
1900 .ad
1901 .sp .6
1902 .RS 4n
1903 An error occurred.
1904 .RE
1906 .sp
1907 .ne 2
1908 .na
1909 \fB\fB2\fR\fR
1910 .ad
1911 .sp .6
1912 .RS 4n
1913 Invalid usage.
1914 .RE
1916 .SH ATTRIBUTES
1917 .LP
1918 See \fBattributes\fR(5) for descriptions of the following attributes:
1919 .sp
1921 .sp
1922 .TS
1923 box;
1924 c | c
1925 l | l .
1926 ATTRIBUTE TYPE ATTRIBUTE VALUE
1927 _
1928 Interface Stability Volatile
1929 .TE
1931 .SH SEE ALSO
1932 .LP
1933 \fBppriv\fR(1), \fBprctl\fR(1), \fBzlogin\fR(1), \fBkstat\fR(8),
1934 \fBmount\fR(8), \fBpooladm\fR(8), \fBpoolcfg\fR(8), \fBpoold\fR(8),
1935 \fBrcapd\fR(8), \fBrctladm\fR(8), \fBsvcadm\fR(8), \fBipadm\fR(8),
1936 \fBzfs\fR(8), \fBzoneadm\fR(8), \fBpriv_str_to_set\fR(3C),
1937 \fBkstat\fR(3KSTAT), \fBvfstab\fR(4), \fBattributes\fR(5), \fBbrands\fR(5),
1938 \fBfnmatch\fR(5), \fBlx\fR(5), \fBprivileges\fR(5), \fBresource_controls\fR(5),
1939 \fBsecurity-flags\fR(5), \fBzones\fR(5)
1940 .sp
1941 .LP
1942 \fISystem Administration Guide: Solaris Containers-Resource Management, and
1943 Solaris Zones\fR
1944 .SH NOTES
1945 .LP
1946 All character data used by \fBzonecfg\fR must be in US-ASCII encoding.