oracle solaris 11 virtualization - deep woodsoracle solaris 11 – hands on lab for oracle employees...

Oracle Solaris 11 – Hands On Lab

For Oracle employees and authorized partners only. Do not distribute to third parties.

© 2011 Oracle Corporation

of 24

Oracle Solaris 11 Virtualization

1 Introduction

This lab will introduce us to the basics of Oracle Solaris 11 virtualization, also known as Zones. You will become familiar with the basic operations of Oracle Solaris Zone configuration and management in Oracle Solaris 11. In Oracle Solaris 10, zones technology gave us the ability to create different isolated environments to suit the needs of particular applications, all running on the same instance of Oracle Solaris. Instead of running and managing multiple operating systems to host multiple applications on multiple systems, you could run and manage only one OS and place each application inside a zone, so instead of having to spend time and resources managing multiple OS’s on different machines, all you needed to do was manage multiple zones on one system which resulted in a much simpler management experience. Oracle Solaris 11 places Zones technology at its core, integrating Oracle Solaris Zones with key Solaris 11 features like tight integration with the new software management architecture which makes deployment of Oracle Solaris 11 and Oracle Solaris Zones easy. Oracle Solaris Zones let you separate one application from others on the same OS allowing you to create isolated environments where users can log in and do what they want without affecting anything outside that zone. In addition, Oracle Solaris Zones also are secure from external attacks and internal malicious programs. Each Oracle Solaris Zone contains a complete resource-controlled environment that allows you to allocate resources such as CPU, memory, networking, and storage. Administrators can choose to closely manage all the Oracle Solaris Zones or they can assign rights to other administrators for specific Oracle Solaris Zones. This flexibility lets us tailor an entire computing environment to the needs of a particular application, all within the same OS.

2 Overview

In this how-to guide, we will set up three Oracle Solaris Zones in a simulated real world environment. This lab is meant to loosely represent a fictitious customer




of 24

that runs a production web sales application and has an in-house development team working on that sales application. The first zone represents the developers’ environment. The second zone represents the production web point of sales environment, and the second zone represents a quickly deployed second instance of the production environment in a reaction to high customer demand on the first web instance.

As we create each zone, we will highlight a specific feature of Oracle Solaris Zones technology. Our zones will be named ‘testzone’, ‘webzone-1’, and ‘webzone-2’ respectively. ‘testzone’ will illustrate how to create a zone using the command line. ‘webzone-1’ will demonstrate how to add a simple application to a zone. And ‘webzone-2’ will show us how to clone a zone for quick deployment in the enterprise.

After following the procedures in this article, you will have three zone environments configured as shown in the figure below.

Each zone will have its file system placed on the /zones ZFS data set and an exclusive network connection through the physical data link (net0/e1000g0). The Web zones will also have the Apache Web server application installed.

Note: "Global zone" refers to the default zone for the system, which is also used for system-wide administrative control.

3 Pre-requisites

This lab requires the use of the following elements:

A current laptop with at least 3GB memory and 100GB free disk space Oracle VirtualBox Software (4.0.16 with Extension Pack installed) Oracle Solaris 11 11/11 Base Text Image (sol-11-1111-text-x86.iso)




of 24

Oracle Solaris IPS Repository (sol-11-1111-repo-full.iso) Oracle Solaris ‘AI Server’ VirtualBox instance that has been set up earlier in

Lab #4 – Advanced Installation.

The following assumptions have been made regarding the environment where this lab is being performed:

1. Network connectivity to the Internet is not necessary 2. The AIServer instance will be configured with a static IP as will the zone

systems we will set up.

4 Exercises

4.1 Create ‘testzone’ u

Before we begin with the first zone configuration let’s make sure that zones haven’t been configured on our system yet and that no virtual network devices exist. Remember that we’re using the ‘aiserver’ Oracle Solaris 11 VirtualBox instance that we created for lab #4.

# zfs list | grep zones

# dladm show-link

At this point there shouldn’t be any ZFS data sets associated with zones and no virtual NICs.

Follow the configuration flow below using the zonecfg command line tool to create the testzone.

# zonecfg –z testzone

An interactive configuration screen will prompt you through a few configuration questions. We will set the default zonepath, autoboot to ‘true’ and enable verbose booting where we can watch all the messaging. Enter the below options and follow along with the screen shot below.

# zonecfg:testzone> create

# zonecfg:testzone> set zonepath=/zones/testzone




of 24

# zonecfg:testzone> set autoboot=true

# zonecfg:testzone> set bootargs=”-m verbose”

# zonecfg:testzone> verify

# zonecfg:testzone> commit

# zonecfg:testzone> exit

Type the following command to verify the zone we’ve created and check its status.

# zoneadm list –cv

Now it’s time to install the zone. Be sure to keep in mind that Zones in Oracle Solaris 11 are enabled by using IPS. When running the installation it will utilize IPS to download the install image. In this case we have configured (in an earlier lab) the IPS Repository locally on the aiserver itself and changed the publisher to reflect this. Verify that the publisher is still set to the local repo by typing in the following command and noting the output.

# pkg publisher

Our publisher should still be set to http://192.168.1.222/

Install the zone by typing the following command:

# zoneadm –z testzone install




of 24

Installation should take approximately 8-10 minutes or less depending on your system. This is rather fast compared to installing from media or other methods.

Once your system is installed you should see a ‘Done: Installation Completed” message. Let’s check the status of the zone we just installed.

# zoneadm list –iv




of 24

Note: There are two switches you can use with the zoneadm list command, ‘-i’ lists all ‘installed zones’, and ‘-c’ lists all ‘configured zones. See the man page for more information.

The zonepath must be on a ZFS data set. It’s created automatically as part of the zoneadm install command. We can check if our file system has been created with the ‘zfs list’ command.

# zfs list | grep zone

Note that the /zones and /zones/testzone data sets have been created automatically. ZFS functionality is critical in providing snapshots and clones for Oracle Solaris Zones which we’ll see later on in the lab.

Also take note that our zone is only 335MB as indicated in the output above. Zones are very lightweight and have a minimal footprint on system resources like storage.

And the final step in getting our testzone instance up and running is to boot and complete the system configuration. Run the following command to boot the zone and access the system console. –z specifies the zone name and –C allows us to login to the console once it’s booted.

# zoneadm –z testzone boot; zlogin –C testzone




of 24

You’ll see the ‘verbose’ option that we set when we created the zone and in a moment you’ll see the SCI Tool (System Configuration) start so we can begin configuring our zone.

Carefully follow the prompts and enter the basic system information listed in the table below.

Note: While editing this lab, I encountered an issue in the zone terminal screen where the F2 key didn’t work and it resorted to normal terminal behavior of ESC-2 instead. However, the arrow keys, tab keys, etc. only worked one way in the choice fields so if you moved past a selection accidentally you might not be able to go back. I’ve reported this minor issue and hope to figure it out in future labs. If you get stuck, you’ll need to restart the zone installation.




of 24

Parameter Information Computer Name: testzone Wired Network Configuration: Manually IP Address: 192.168.1.118 Netmask: 255.255.255.0 Router: 192.168.1.1 Name Service Configuration: Do Not Configure DNS Other Name Service Configuration: None Region: UTC/GMT Root password: solaris11 Real Name Zone User Username: Zoneuser User password: solaris11

You should see some more verbose messaging and then in a matter of moments be presented with a login to our newly created testzone.

We don’t need to login to the zone just yet so let’s exit the ‘testzone’ console. You can exit a console by pressing the ~ and . in sequence ‘<shift>~.’ This will close the




of 24

connection for us.

Once back at the global zone let’s check the status of ‘testzone’. Use the zoneadm list command.

# zoneadm list -v

Run the ‘dladm’ command to see what’s happened to our network interfaces.

# dladm show-link

There in the listing is the VNIC that was created for us when we created the testzone zone.

Let’s login to our zone and check things out.

Run these commands and compare them to the output of the below screen shot.

# zlogin testzone

# uname –a

# ipadm show-addr

# dladm show-link




of 24

We can see that testzone is a fully functional Oracle Solaris 11 machine with a configured IPv4 NIC called net0/v4, and we have a network link called net0. Let’s check out our file system.

# zfs list

The ‘zfs list’ command shows the ZFS dataset that the zone is running on. Note that we can’t see the global zfs file system.

At this point the testzone instance is up and running. We could configure users, delegate administration, and anything that we would normally do to set up servers to start doing useful work.

Exit testzone – (~.)

New in Oracle Solaris 11 zones is that they’re automatically created with exclusive IP resources by default. This means that a Solaris Zone has access to a complete network stack which allows flexibility and performance in zone networking that didn’t exist before. Let’s take a look at the zone networking properties with the info switch to our zonecfg command.

From the global zone run this command.

# zonecfg –z testzone info




of 24

The anet device is configured automatically. This resource is created and destroyed automatically when the zone is brought up and shut down respectively. Let’s take a closer look. Important information in this output is … mac address is set to = random linkname is = net0 link-protection is set to – mac-nospoof ip-type = exclusive autoboot = true # ipadm show-addr

# dladm show-link




of 24

The VNIC testzone/net0 has automatically been created for testzone. Login to testzone and see what it looks like from there. # zlogin testzone

# dladm show-link

# ipadm show-addr

Ping the global zone to see if things are working correctly. # ping 192.168.1.222

Exit testzone (~.)

4.2 Create ‘webzone-1’ and add an application

In the second step of our lab we’ll add another zone to our system and add a specific application to it.

We’ll start our zone setup a little differently by creating the zone on a single command line with the minimum amount of information required. Enter the following command to begin installing our new zone.

# zonecfg –z webzone-1 “create ; set zonepath=/zones/webzone-1”

# zonecfg -z webzone-1 info




of 24

This example shows how quick and easy it is to setup zones in Solaris 11. The next step will be to install the zone. Our packages are coming from our internal repository so give this lab a few minutes to complete.

# zoneadm -z webzone-1 install




of 24

For the next step we’ll boot and do our initial configuration. # zoneadm –z webzone-1 boot; zlogin –C webzone-1

Once webzone-1 finishes booting and brings up the system configuration tool. Enter the following information:

Parameter Information Computer Name: webzone-1 Wired Network Configuration: Manually IP Address: 192.168.1.119 Netmask: 255.255.255.0 Router: 192.168.1.1 Name Service Configuration: Do Not Configure DNS Other Name Service Configuration: None Region: UTC/GMT Root password: solaris11 Real Name Zone User Username: Zoneuser User password: solaris11




of 24

Confirm your settings and apply. Next we’ll need to login to webzone-1 and add the apache web server package. # zlogin webzone-1

# pkg info /web/server/apache-22

The pkg info command finds that apache-22 isn’t installed. Now let’s ask it to look into our ‘remote’ repository. (It’s actually on this machine but it’s still remote to our zone) to see if it’s there.

# pkg info –r /web/server/apache-22




of 24

We supply the ‘-r’ switch to look into the remote repository for information. And there it is so let’s go ahead and install it

# pkg install /web/server/apache-22

We see that IPS downloads all the related files we need and there is no need for us to figure out the dependencies. In this case, three packages were installed. We can check the status of the Apache Web server by using the pkg info command again, as shown below.





of 24

Look at the State: field and you’ll see that our package is installed. We now have a useful zone that can be configured and run as a real webserver.

4.3 Use the clone feature to create ‘webzone-2’

We could easily repeat the process we just used to create more zones but in this case we want a duplicate environment and there’s an easier way to do it. It’s quick and easy to just make a clone of webzone-1. Webzone-1 will serve as our global master for this creation. To start this process we’ll create a configuration ID template for webzone-2 that can be easily edited and replicated to make installation even easier. We’ll be using the sysconfig command to create our configuration template for this lab. Start by logging in to webzone-1 # zlogin webzone-1

Now let’s create our profile and store it as a template that we can use later. Use the same information from the other zones with the exception of the name and a new IP address. # sysconfig create-profile –o /root/webzone-2-template.xml

Parameter Information Computer Name: webzone-2 Wired Network Configuration: Manually IP Address: 192.168.1.120 Netmask: 255.255.255.0 Router: 192.168.1.1 Name Service Configuration: Do Not Configure DNS Other Name Service Configuration: None Region: UTC/GMT Root password: solaris11 Real Name Zone User Username: zoneusr2 User password: solaris11 Confirm the SCI Tool information with the screen below:




of 24

Type ‘ls’ to verify your template file has been created and log out of the zone:

# ls

# exit

Note: When using the sysconfig tool on the webzone-1 instance, we’re not allowed to use existing user names in the user account section. In this case, we could not use the user name zoneuser so we chose zoneusr2 instead.

Now we’ll create the zone profile. From the global zone we need to halt webzone-1. It’s not recommended to clone a running zone. Then use zoneadm list to verify that the zone is shut down.




of 24

# zoneadm –z webzone-1 shutdown

# zoneadm list -iv

Next we’ll need to capture the zone configuration and use it as a profile template for any other zones we want to create. In this case we’ll use it to create webzone-2.

# zonecfg –z webzone-1 export –f /zones/webzone-2-profile

In the next step we’ll edit the webzone-2-profile in order to add our specific zone information. Use vi or your favorite editor to edit webzone-2-profile and make these changes.

Change ‘set zonepath=/zones/webzone-1 to ‘set zonepath=/zones/webzone-2’ Change ‘set autoboot=false’ to ‘set autoboot=true’

Now we want to place the system configuration template (webzone-2-template.xml) that we created earlier in a more convenient location. We can access the file location from the global zone even though webzone-1 is shut down. Type the following commands to copy the template into a new location:

# cp /zones/webzone-1/root/root/webzone-2-template.xml /zones

# ls /zones




of 24

Create webzone-2 by cloning webzone-1. We will use zonecfg to create webzone-2 with our modified configuration file. Then we’ll perform the clone by using the zoneadm command. Remember to use the full path to the configuration template.

Note the quick completion of the clone and how quickly our new environment is created. We’ve prepended the ‘time’ switch onto our zoneadm command in order to gauge the time it takes to create the clone.

# zonecfg –z webzone-2 –f /zones/webzone-2-profile

# time zoneadm –z webzone-2 clone –c /zones/webzone-2-template.xml \

webzone-1

Our clone only took about 4 seconds to create. The clone command takes advantage of the ZFS snapshot capability to produce near instant zone environments. Another benefit of clone technology is that it doesn’t use up our storage resources. Do a quick diskspace check with the zfs list command:

# zfs list | grep webzone




of 24

Even after we added the Apache Web server, webzone-1 is only 390 MB. Even better, webzone-2, an exact copy of webzone-1, is only 342 K, providing a huge

savings on disk space.

Finally, boot webzone-2 and watch the console. Occasionally, you will see the

system configuration being applied. You can see below that the host name has been set for us from the template.

# zoneadm –z webzone-2 boot; zlogin –C webzone-2

Note that our hostname has been set via the template that we edited. Keep in mind that we could easily edit and create more templates to quickly deploy lots of zones quickly and easily.

Exit the console. (~.)

Let’s verify that our clone is intact and different than a normal installation.

# zlogin webzone-2




of 24


The Apache web server package is included in this clone as you can see. Cloning is frequently used when a “master” zone is created with all the additional necessary packages and configurations in place. The “master” is simply cloned as new environments are required.

As a final check, let’s make sure our IP addressing was applied properly.

# ipadm show-addr

Note: For future reference and even faster and more efficient installations, Oracle Solaris Automated Installer also provides a method for creating zones as part of the system install service.

4.4 Uninstall your zones (informational only)

The lab is complete but just in case you made mistakes or want to start over on a zone here is the procedure for removing a zone. Use this procedure with caution as the action of removing a zone and all the files in it is irreversible.

Become superuser or assume the primary administrator role. List the zones on the system:




of 24

# su –

# zoneadm list –iv

Use the zoneadm command with the –z uninstall option to remove the zone – webzone-1. We’ll also use the –F to force the removal in case there are issues.

Note: Remember this action can’t be undone.

# zoneadm –z webzone-1 uninstall –F

For further cleanup we need to also remove the zone configuration. Type the following command:

# zonecfg –z webzone-1 delete –F

# zoneadm list -iv

Run a zfs list and grep for ‘webzone-1’ to verify the filesystem has been removed.

# zfs list |grep webzone-1




of 24

5 Lab Summary

This lab has given you the opportunity to configure Oracle Solaris Zones technology utilizing several methods to see how easy and efficient installing and running zones can be. You observed the tight integration with the operating system. We installed 3 zones, one from the command line, one with an application, and the final zone by taking advantage of the clone feature of the ZFS file system. Oracle Solaris Zones is a powerful application that allows us to separate one application from others on the same system creating a powerful, secure, and flexible computing environment.

6 References

For more information and next steps, please consult additional resources: Click the hyperlinks to access the resource.

Oracle Solaris 11 Technology Spotlights

Oracle Solaris 11 Information Library

Oracle Solaris 11 Product Documentation

Oracle Solaris 11 Documentation: Zones Administration

How to Set Up Load Balanced Application across Oracle Solaris Zones

How to Restrict Traffic Using Virtualization and Resource Management

http://www.oracle.com/technetwork/server-storage/solaris11/technologies

http://docs.oracle.com/cd/E23824_01/index.html

http://www.oracle.com/technetwork/server-storage/solaris11/documentation/index.html

http://docs.oracle.com/cd/E23824_01/html/821-1460/index.html

http://www.oracle.com/technetwork/articles/servers-storage-admin/loadbalancedapp-1653020.html

http://www.oracle.com/technetwork/articles/servers-storage-admin/loadbalancedapp-1653020.html

oracle solaris 11 virtualization - deep woodsoracle solaris 11 – hands on lab for oracle employees...

Documents