1 ZONECFG(1M)                  Maintenance Commands                  ZONECFG(1M)
   2 
   3 
   4 
   5 NAME
   6        zonecfg - set up zone configuration
   7 
   8 SYNOPSIS
   9        zonecfg -z zonename
  10 
  11 
  12        zonecfg -z zonename subcommand
  13 
  14 
  15        zonecfg -z zonename -f command_file
  16 
  17 
  18        zonecfg help
  19 
  20 
  21 DESCRIPTION
  22        The zonecfg utility creates and modifies the configuration of a zone.
  23        Zone configuration consists of a number of resources and properties.
  24 
  25 
  26        To simplify the user interface, zonecfg uses the concept of a scope.
  27        The default scope is global.
  28 
  29 
  30        The following synopsis of the zonecfg command is for interactive usage:
  31 
  32          zonecfg -z zonename subcommand
  33 
  34 
  35 
  36 
  37        Parameters changed through zonecfg do not affect a running zone. The
  38        zone must be rebooted for the changes to take effect.
  39 
  40 
  41        In addition to creating and modifying a zone, the zonecfg utility can
  42        also be used to persistently specify the resource management settings
  43        for the global zone.
  44 
  45 
  46        In the following text, "rctl" is used as an abbreviation for "resource
  47        control". See resource_controls(5).
  48 
  49 
  50        Every zone is configured with an associated brand. The brand determines
  51        the user-level environment used within the zone, as well as various
  52        behaviors for the zone when it is installed, boots, or is shutdown.
  53        Once a zone has been installed the brand cannot be changed. The default
  54        brand is determined by the installed distribution in the global zone.
  55        Some brands do not support all of the zonecfg properties and resources.
  56        See the brand-specific man page for more details on each brand. For an
  57        overview of brands, see the brands(5) man page.
  58 
  59    Resources
  60        The following resource types are supported:
  61 
  62        attr
  63 
  64            Generic attribute.
  65 
  66 
  67        capped-cpu
  68 
  69            Limits for CPU usage.
  70 
  71 
  72        capped-memory
  73 
  74            Limits for physical, swap, and locked memory.
  75 
  76 
  77        dataset
  78 
  79            ZFS dataset.
  80 
  81 
  82        dedicated-cpu
  83 
  84            Subset of the system's processors dedicated to this zone while it
  85            is running.
  86 
  87 
  88        device
  89 
  90            Device.
  91 
  92 
  93        fs
  94 
  95            file-system
  96 
  97 
  98        net
  99 
 100            Network interface.
 101 
 102 
 103        rctl
 104 
 105            Resource control.
 106 
 107 
 108        security-flags
 109 
 110            Process security flag settings.
 111 
 112 
 113    Properties
 114        Each resource type has one or more properties. There are also some
 115        global properties, that is, properties of the configuration as a whole,
 116        rather than of some particular resource.
 117 
 118 
 119        The following properties are supported:
 120 
 121        (global)
 122 
 123            zonename
 124 
 125 
 126        (global)
 127 
 128            zonepath
 129 
 130 
 131        (global)
 132 
 133            autoboot
 134 
 135 
 136        (global)
 137 
 138            bootargs
 139 
 140 
 141        (global)
 142 
 143            pool
 144 
 145 
 146        (global)
 147 
 148            limitpriv
 149 
 150 
 151        (global)
 152 
 153            brand
 154 
 155 
 156        (global)
 157 
 158            cpu-shares
 159 
 160 
 161        (global)
 162 
 163            hostid
 164 
 165 
 166        (global)
 167 
 168            max-lwps
 169 
 170 
 171        (global)
 172 
 173            max-msg-ids
 174 
 175 
 176        (global)
 177 
 178            max-sem-ids
 179 
 180 
 181        (global)
 182 
 183            max-shm-ids
 184 
 185 
 186        (global)
 187 
 188            max-shm-memory
 189 
 190 
 191        (global)
 192 
 193            scheduling-class
 194 
 195 
 196        (global)
 197 
 198            fs-allowed
 199 
 200 
 201        fs
 202 
 203            dir, special, raw, type, options
 204 
 205 
 206        net
 207 
 208            address, physical, defrouter
 209 
 210 
 211        device
 212 
 213            match
 214 
 215 
 216        rctl
 217 
 218            name, value
 219 
 220 
 221        attr
 222 
 223            name, type, value
 224 
 225 
 226        dataset
 227 
 228            name
 229 
 230 
 231        dedicated-cpu
 232 
 233            ncpus, importance
 234 
 235 
 236        capped-memory
 237 
 238            physical, swap, locked
 239 
 240 
 241        capped-cpu
 242 
 243            ncpus
 244 
 245 
 246        security-flags
 247 
 248            lower, default, upper.
 249 
 250 
 251 
 252        As for the property values which are paired with these names, they are
 253        either simple, complex, or lists. The type allowed is property-
 254        specific. Simple values are strings, optionally enclosed within
 255        quotation marks. Complex values have the syntax:
 256 
 257          (<name>=<value>,<name>=<value>,...)
 258 
 259 
 260 
 261 
 262        where each <value> is simple, and the <name> strings are     unique within
 263        a given property. Lists have the syntax:
 264 
 265          [<value>,...]
 266 
 267 
 268 
 269 
 270        where each <value> is either simple or complex. A list of a single
 271        value (either simple or complex) is equivalent to specifying that value
 272        without the list syntax. That is, "foo" is equivalent to "[foo]". A
 273        list can be empty (denoted by "[]").
 274 
 275 
 276        In interpreting property values, zonecfg accepts regular expressions as
 277        specified in fnmatch(5). See EXAMPLES.
 278 
 279 
 280        The property types are described as follows:
 281 
 282        global: zonename
 283 
 284            The name of the zone.
 285 
 286 
 287        global: zonepath
 288 
 289            Path to zone's file system.
 290 
 291 
 292        global: autoboot
 293 
 294            Boolean indicating that a zone should be booted automatically at
 295            system boot.  Note that if the zones service is disabled, the zone
 296            will not autoboot, regardless of the setting of this property. You
 297            enable the zones service with a svcadm command, such as:
 298 
 299              # svcadm enable svc:/system/zones:default
 300 
 301 
 302            Replace enable with disable to disable the zones service. See
 303            svcadm(1M).
 304 
 305 
 306        global: bootargs
 307 
 308            Arguments (options) to be passed to the zone bootup, unless options
 309            are supplied to the "zoneadm boot" command, in which case those
 310            take precedence. The valid arguments are described in zoneadm(1M).
 311 
 312 
 313        global: pool
 314 
 315            Name of the resource pool that this zone must be bound to when
 316            booted. This property is incompatible with the dedicated-cpu
 317            resource.
 318 
 319 
 320        global: limitpriv
 321 
 322            The maximum set of privileges any process in this zone can obtain.
 323            The property should consist of a comma-separated privilege set
 324            specification as described in priv_str_to_set(3C). Privileges can
 325            be excluded from the resulting set by preceding their names with a
 326            dash (-) or an exclamation point (!). The special privilege string
 327            "zone" is not supported in this context. If the special string
 328            "default" occurs as the first token in the property, it expands
 329            into a safe set of privileges that preserve the resource and
 330            security isolation described in zones(5). A missing or empty
 331            property is equivalent to this same set of safe privileges.
 332 
 333            The system administrator must take extreme care when configuring
 334            privileges for a zone. Some privileges cannot be excluded through
 335            this mechanism as they are required in order to boot a zone. In
 336            addition, there are certain privileges which cannot be given to a
 337            zone as doing so would allow processes inside a zone to unduly
 338            affect processes in other zones. zoneadm(1M) indicates when an
 339            invalid privilege has been added or removed from a zone's privilege
 340            set when an attempt is made to either "boot" or "ready" the zone.
 341 
 342            See privileges(5) for a description of privileges. The command
 343            "ppriv -l" (see ppriv(1)) produces a list of all Solaris
 344            privileges. You can specify privileges as they are displayed by
 345            ppriv. In privileges(5), privileges are listed in the form
 346            PRIV_privilege_name. For example, the privilege sys_time, as you
 347            would specify it in this property, is listed in privileges(5) as
 348            PRIV_SYS_TIME.
 349 
 350 
 351        global: brand
 352 
 353            The zone's brand type.
 354 
 355 
 356        global: ip-type
 357 
 358            A zone can either share the IP instance with the global zone, which
 359            is the default, or have its own exclusive instance of IP.
 360 
 361            This property takes the values shared and exclusive.
 362 
 363 
 364        global: hostid
 365 
 366            A zone can emulate a 32-bit host identifier to ease system
 367            consolidation. A zone's hostid property is empty by default,
 368            meaning that the zone does not emulate a host identifier. Zone host
 369            identifiers must be hexadecimal values between 0 and FFFFFFFE. A 0x
 370            or 0X prefix is optional. Both uppercase and lowercase hexadecimal
 371            digits are acceptable.
 372 
 373 
 374        fs: dir, special, raw, type, options
 375 
 376            Values needed to determine how, where, and so forth to mount file
 377            systems. See mount(1M), mount(2), fsck(1M), and vfstab(4).
 378 
 379 
 380        net: address, physical, defrouter
 381 
 382            The network address and physical interface name of the network
 383            interface. The network address is one of:
 384 
 385                o      a valid IPv4 address, optionally followed by "/" and a
 386                       prefix length;
 387 
 388                o      a valid IPv6 address, which must be followed by "/" and
 389                       a prefix length;
 390 
 391                o      a host name which resolves to an IPv4 address.
 392            Note that host names that resolve to IPv6 addresses are not
 393            supported.
 394 
 395            The physical interface name is the network interface name.
 396 
 397            The default router is specified similarly to the network address
 398            except that it must not be followed by a / (slash) and a network
 399            prefix length.
 400 
 401            A zone can be configured to be either exclusive-IP or shared-IP.
 402            For a shared-IP zone, you must set both the physical and address
 403            properties; setting the default router is optional. The interface
 404            specified in the physical property must be plumbed in the global
 405            zone prior to booting the non-global zone. However, if the
 406            interface is not used by the global zone, it should be configured
 407            down in the global zone, and the default router for the interface
 408            should be specified here.
 409 
 410            For an exclusive-IP zone, the physical property must be set and the
 411            address and default router properties cannot be set.
 412 
 413 
 414        device: match
 415 
 416            Device name to match.
 417 
 418 
 419        rctl: name, value
 420 
 421            The name and priv/limit/action triple of a resource control.  See
 422            prctl(1) and rctladm(1M). The preferred way to set rctl values is
 423            to use the global property name associated with a specific rctl.
 424 
 425 
 426        attr: name, type, value
 427 
 428            The name, type and value of a generic attribute. The type must be
 429            one of int, uint, boolean or string, and the value must be of that
 430            type. uint means unsigned , that is, a non-negative integer.
 431 
 432 
 433        dataset: name
 434 
 435            The name of a ZFS dataset to be accessed from within the zone. See
 436            zfs(1M).
 437 
 438 
 439        global: cpu-shares
 440 
 441            The number of Fair Share Scheduler (FSS) shares to allocate to this
 442            zone. This property is incompatible with the dedicated-cpu
 443            resource. This property is the preferred way to set the zone.cpu-
 444            shares rctl.
 445 
 446 
 447        global: max-lwps
 448 
 449            The maximum number of LWPs simultaneously available to this zone.
 450            This property is the preferred way to set the zone.max-lwps rctl.
 451 
 452 
 453        global: max-msg-ids
 454 
 455            The maximum number of message queue IDs allowed for this zone. This
 456            property is the preferred way to set the zone.max-msg-ids rctl.
 457 
 458 
 459        global: max-sem-ids
 460 
 461            The maximum number of semaphore IDs allowed for this zone. This
 462            property is the preferred way to set the zone.max-sem-ids rctl.
 463 
 464 
 465        global: max-shm-ids
 466 
 467            The maximum number of shared memory IDs allowed for this zone. This
 468            property is the preferred way to set the zone.max-shm-ids rctl.
 469 
 470 
 471        global: max-shm-memory
 472 
 473            The maximum amount of shared memory allowed for this zone. This
 474            property is the preferred way to set the zone.max-shm-memory rctl.
 475            A scale (K, M, G, T) can be applied to the value for this number
 476            (for example, 1M is one megabyte).
 477 
 478 
 479        global: scheduling-class
 480 
 481            Specifies the scheduling class used for processes running in a
 482            zone. When this property is not specified, the scheduling class is
 483            established as follows:
 484 
 485                o      If the cpu-shares property or equivalent rctl is set,
 486                       the scheduling class FSS is used.
 487 
 488                o      If neither cpu-shares nor the equivalent rctl is set and
 489                       the zone's pool property references a pool that has a
 490                       default scheduling class, that class is used.
 491 
 492                o      Under any other conditions, the system default
 493                       scheduling class is used.
 494 
 495 
 496 
 497 
 498        dedicated-cpu: ncpus, importance
 499 
 500            The number of CPUs that should be assigned for this zone's
 501            exclusive use. The zone will create a pool and processor set when
 502            it boots. See pooladm(1M) and poolcfg(1M) for more information on
 503            resource pools. The ncpu property can specify a single value or a
 504            range (for example, 1-4) of processors. The importance property is
 505            optional; if set, it will specify the pset.importance value for use
 506            by poold(1M). If this resource is used, there must be enough free
 507            processors to allocate to this zone when it boots or the zone will
 508            not boot. The processors assigned to this zone will not be
 509            available for the use of the global zone or other zones. This
 510            resource is incompatible with both the pool and cpu-shares
 511            properties. Only a single instance of this resource can be added to
 512            the zone.
 513 
 514 
 515        capped-memory: physical, swap, locked
 516 
 517            The caps on the memory that can be used by this zone. A scale (K,
 518            M, G, T) can be applied to the value for each of these numbers (for
 519            example, 1M is one megabyte). Each of these properties is optional
 520            but at least one property must be set when adding this resource.
 521            Only a single instance of this resource can be added to the zone.
 522            The physical property sets the max-rss for this zone. This will be
 523            enforced by rcapd(1M) running in the global zone.  The swap
 524            property is the preferred way to set the zone.max-swap rctl. The
 525            locked property is the preferred way to set the zone.max-locked-
 526            memory rctl.
 527 
 528 
 529        capped-cpu: ncpus
 530 
 531            Sets a limit on the amount of CPU time that can be used by a zone.
 532            The unit used translates to the percentage of a single CPU that can
 533            be used by all user threads in a zone, expressed as a fraction (for
 534            example, .75) or a mixed number (whole number and fraction, for
 535            example, 1.25). An ncpu value of 1 means 100% of a CPU, a value of
 536            1.25 means 125%, .75 mean 75%, and so forth. When projects within a
 537            capped zone have their own caps, the minimum value takes
 538            precedence.
 539 
 540            The capped-cpu property is an alias for zone.cpu-cap resource
 541            control and is related to the zone.cpu-cap resource control. See
 542            resource_controls(5).
 543 
 544 
 545        security-flags: lower, default, upper
 546 
 547            Set the process security flags associated with the zone.  The lower
 548            and upper fields set the limits, the default field is set of flags
 549            all zone processes inherit.
 550 
 551 
 552        global: fs-allowed
 553 
 554            A comma-separated list of additional filesystems that may be
 555            mounted within the zone; for example "ufs,pcfs". By default, only
 556            hsfs(7fs) and network filesystems can be mounted. If the first
 557            entry in the list is "-" then that disables all of the default
 558            filesystems. If any filesystems are listed after "-" then only
 559            those filesystems can be mounted.
 560 
 561            This property does not apply to filesystems mounted into the zone
 562            via "add fs" or "add dataset".
 563 
 564            WARNING: allowing filesystem mounts other than the default may
 565            allow the zone administrator to compromise the system with a
 566            malicious filesystem image, and is not supported.
 567 
 568 
 569 
 570        The following table summarizes resources, property-names, and types:
 571 
 572          resource          property-name   type
 573          (global)          zonename        simple
 574          (global)          zonepath        simple
 575          (global)          autoboot        simple
 576          (global)          bootargs        simple
 577          (global)          pool            simple
 578          (global)          limitpriv       simple
 579          (global)          brand           simple
 580          (global)          ip-type         simple
 581          (global)          hostid          simple
 582          (global)          cpu-shares      simple
 583          (global)          max-lwps        simple
 584          (global)          max-msg-ids     simple
 585          (global)          max-sem-ids     simple
 586          (global)          max-shm-ids     simple
 587          (global)          max-shm-memory  simple
 588          (global)          scheduling-class simple
 589          fs                dir             simple
 590                             special         simple
 591                             raw             simple
 592                             type            simple
 593                             options         list of simple
 594          net               address         simple
 595                             physical        simple
 596          device            match           simple
 597          rctl              name            simple
 598                             value           list of complex
 599          attr              name            simple
 600                             type            simple
 601                             value           simple
 602          dataset           name            simple
 603          dedicated-cpu     ncpus           simple or range
 604                             importance      simple
 605 
 606          capped-memory     physical        simple with scale
 607                             swap            simple with scale
 608                             locked          simple with scale
 609 
 610          capped-cpu        ncpus           simple
 611          security-flags   lower           simple
 612                             default        simple
 613                             upper          simple
 614 
 615 
 616 
 617 
 618        To further specify things, the breakdown of the complex property
 619        "value" of the "rctl" resource type, it consists of three name/value
 620        pairs, the names being "priv", "limit" and "action", each of which
 621        takes a simple value. The "name" property of an "attr" resource is
 622        syntactically restricted in a fashion similar but not identical to zone
 623        names: it must begin with an alphanumeric, and can contain
 624        alphanumerics plus the hyphen (-), underscore (_), and dot (.)
 625        characters. Attribute names beginning with "zone" are reserved for use
 626        by the system. Finally, the "autoboot" global property must have a
 627        value of "true" or "false".
 628 
 629    Using Kernel Statistics to Monitor CPU Caps
 630        Using the kernel statistics (kstat(3KSTAT)) module caps, the system
 631        maintains information for all capped projects and zones. You can access
 632        this information by reading kernel statistics (kstat(3KSTAT)),
 633        specifying caps as the kstat module name. The following command
 634        displays kernel statistics for all active CPU caps:
 635 
 636          # kstat caps::'/cpucaps/'
 637 
 638 
 639 
 640 
 641        A kstat(1M) command running in a zone displays only CPU caps relevant
 642        for that zone and for projects in that zone. See EXAMPLES.
 643 
 644 
 645        The following are cap-related arguments for use with kstat(1M):
 646 
 647        caps
 648 
 649            The kstat module.
 650 
 651 
 652        project_caps or zone_caps
 653 
 654            kstat class, for use with the kstat -c option.
 655 
 656 
 657        cpucaps_project_id or cpucaps_zone_id
 658 
 659            kstat name, for use with the kstat -n option. id is the project or
 660            zone identifier.
 661 
 662 
 663 
 664        The following fields are displayed in response to a kstat(1M) command
 665        requesting statistics for all CPU caps.
 666 
 667        module
 668 
 669            In this usage of kstat, this field will have the value caps.
 670 
 671 
 672        name
 673 
 674            As described above, cpucaps_project_id or cpucaps_zone_id
 675 
 676 
 677        above_sec
 678 
 679            Total time, in seconds, spent above the cap.
 680 
 681 
 682        below_sec
 683 
 684            Total time, in seconds, spent below the cap.
 685 
 686 
 687        maxusage
 688 
 689            Maximum observed CPU usage.
 690 
 691 
 692        nwait
 693 
 694            Number of threads on cap wait queue.
 695 
 696 
 697        usage
 698 
 699            Current aggregated CPU usage for all threads belonging to a capped
 700            project or zone, in terms of a percentage of a single CPU.
 701 
 702 
 703        value
 704 
 705            The cap value, in terms of a percentage of a single CPU.
 706 
 707 
 708        zonename
 709 
 710            Name of the zone for which statistics are displayed.
 711 
 712 
 713 
 714        See EXAMPLES for sample output from a kstat command.
 715 
 716 OPTIONS
 717        The following options are supported:
 718 
 719        -f command_file
 720 
 721            Specify the name of zonecfg command file. command_file is a text
 722            file of zonecfg subcommands, one per line.
 723 
 724 
 725        -z zonename
 726 
 727            Specify the name of a zone. Zone names are case sensitive. Zone
 728            names must begin with an alphanumeric character and can contain
 729            alphanumeric characters, the underscore (_) the hyphen (-), and the
 730            dot (.). The name global and all names beginning with SUNW are
 731            reserved and cannot be used.
 732 
 733 
 734 SUBCOMMANDS
 735        You can use the add and select subcommands to select a specific
 736        resource, at which point the scope changes to that resource. The end
 737        and cancel subcommands are used to complete the resource specification,
 738        at which time the scope is reverted back to global. Certain
 739        subcommands, such as add, remove and set, have different semantics in
 740        each scope.
 741 
 742 
 743        zonecfg supports a semicolon-separated list of subcommands. For
 744        example:
 745 
 746          # zonecfg -z myzone "add net; set physical=myvnic; end"
 747 
 748 
 749 
 750 
 751        Subcommands which can result in destructive actions or loss of work
 752        have an -F option to force the action. If input is from a terminal
 753        device, the user is prompted when appropriate if such a command is
 754        given without the -F option otherwise, if such a command is given
 755        without the -F option, the action is disallowed, with a diagnostic
 756        message written to standard error.
 757 
 758 
 759        The following subcommands are supported:
 760 
 761        add resource-type (global scope)
 762        add property-name property-value (resource scope)
 763 
 764            In the global scope, begin the specification for a given resource
 765            type. The scope is changed to that resource type.
 766 
 767            In the resource scope, add a property of the given name with the
 768            given value.  The syntax for property values varies with different
 769            property types. In general, it is a simple value or a list of
 770            simple values enclosed in square brackets, separated by commas
 771            ([foo,bar,baz]). See PROPERTIES.
 772 
 773 
 774        cancel
 775 
 776            End the resource specification and reset scope to global. Abandons
 777            any partially specified resources. cancel is only applicable in the
 778            resource scope.
 779 
 780 
 781        clear property-name
 782 
 783            Clear the value for the property.
 784 
 785 
 786        commit
 787 
 788            Commit the current configuration from memory to stable storage. The
 789            configuration must be committed to be used by zoneadm. Until the
 790            in-memory configuration is committed, you can remove changes with
 791            the revert subcommand. The commit operation is attempted
 792            automatically upon completion of a zonecfg session. Since a
 793            configuration must be correct to be committed, this operation
 794            automatically does a verify.
 795 
 796 
 797        create [-F] [ -a path |-b | -t template]
 798 
 799            Create an in-memory configuration for the specified zone. Use
 800            create to begin to configure a new zone. See commit for saving this
 801            to stable storage.
 802 
 803            If you are overwriting an existing configuration, specify the -F
 804            option to force the action. Specify the -t template option to
 805            create a configuration identical to template, where template is the
 806            name of a configured zone.
 807 
 808            Use the -a path option to facilitate configuring a detached zone on
 809            a new host. The path parameter is the zonepath location of a
 810            detached zone that has been moved on to this new host. Once the
 811            detached zone is configured, it should be installed using the
 812            "zoneadm attach" command (see zoneadm(1M)). All validation of the
 813            new zone happens during the attach process, not during zone
 814            configuration.
 815 
 816            Use the -b option to create a blank configuration. Without
 817            arguments, create applies the Sun default settings.
 818 
 819 
 820        delete [-F]
 821 
 822            Delete the specified configuration from memory and stable storage.
 823            This action is instantaneous, no commit is necessary. A deleted
 824            configuration cannot be reverted.
 825 
 826            Specify the -F option to force the action.
 827 
 828 
 829        end
 830 
 831            End the resource specification. This subcommand is only applicable
 832            in the resource scope. zonecfg checks to make sure the current
 833            resource is completely specified. If so, it is added to the in-
 834            memory configuration (see commit for saving this to stable storage)
 835            and the scope reverts to global. If the specification is
 836            incomplete, it issues an appropriate error message.
 837 
 838 
 839        export [-f output-file]
 840 
 841            Print configuration to standard output. Use the -f option to print
 842            the configuration to output-file. This option produces output in a
 843            form suitable for use in a command file.
 844 
 845 
 846        help [usage] [subcommand] [syntax] [command-name]
 847 
 848            Print general help or help about given topic.
 849 
 850 
 851        info zonename | zonepath | autoboot | brand | pool | limitpriv
 852        info [resource-type [property-name=property-value]*]
 853 
 854            Display information about the current configuration. If resource-
 855            type is specified, displays only information about resources of the
 856            relevant type. If any property-name value pairs are specified,
 857            displays only information about resources meeting the given
 858            criteria. In the resource scope, any arguments are ignored, and
 859            info displays information about the resource which is currently
 860            being added or modified.
 861 
 862 
 863        remove resource-type{property-name=property -value}(global scope)
 864 
 865            In the global scope, removes the specified resource. The [] syntax
 866            means 0 or more of whatever is inside the square braces. If you
 867            want only to remove a single instance of the resource, you must
 868            specify enough property name-value pairs for the resource to be
 869            uniquely identified. If no property name-value pairs are specified,
 870            all instances will be removed. If there is more than one pair is
 871            specified, a confirmation is required, unless you use the -F
 872            option.
 873 
 874 
 875        select resource-type {property-name=property-value}
 876 
 877            Select the resource of the given type which matches the given
 878            property-name property-value pair criteria, for modification. This
 879            subcommand is applicable only in the global scope. The scope is
 880            changed to that resource type. The {} syntax means 1 or more of
 881            whatever is inside the curly braces. You must specify enough
 882            property -name property-value pairs for the resource to be uniquely
 883            identified.
 884 
 885 
 886        set property-name=property-value
 887 
 888            Set a given property name to the given value. Some properties (for
 889            example, zonename and zonepath) are global while others are
 890            resource-specific. This subcommand is applicable in both the global
 891            and resource scopes.
 892 
 893 
 894        verify
 895 
 896            Verify the current configuration for correctness:
 897 
 898                o      All resources have all of their required properties
 899                       specified.
 900 
 901                o      A zonepath is specified.
 902 
 903 
 904        revert [-F]
 905 
 906            Revert the configuration back to the last committed state. The -F
 907            option can be used to force the action.
 908 
 909 
 910        exit [-F]
 911 
 912            Exit the zonecfg session. A commit is automatically attempted if
 913            needed.  You can also use an EOF character to exit zonecfg. The -F
 914            option can be used to force the action.
 915 
 916 
 917 EXAMPLES
 918        Example 1 Creating the Environment for a New Zone
 919 
 920 
 921        In the following example, zonecfg creates the environment for a new
 922        zone.  /usr/local is loopback mounted from the global zone into
 923        /opt/local. /opt/sfw is loopback mounted from the global zone, three
 924        logical network interfaces are added, and a limit on the number of
 925        fair-share scheduler (FSS) CPU shares for a zone is set using the rctl
 926        resource type. The example also shows how to select a given resource
 927        for modification.
 928 
 929 
 930          example# zonecfg -z myzone3
 931          my-zone3: No such zone configured
 932          Use 'create' to begin configuring a new zone.
 933          zonecfg:myzone3> create
 934          zonecfg:myzone3> set zonepath=/export/home/my-zone3
 935          zonecfg:myzone3> set autoboot=true
 936          zonecfg:myzone3> add fs
 937          zonecfg:myzone3:fs> set dir=/usr/local
 938          zonecfg:myzone3:fs> set special=/opt/local
 939          zonecfg:myzone3:fs> set type=lofs
 940          zonecfg:myzone3:fs> add options [ro,nodevices]
 941          zonecfg:myzone3:fs> end
 942          zonecfg:myzone3> add fs
 943          zonecfg:myzone3:fs> set dir=/mnt
 944          zonecfg:myzone3:fs> set special=/dev/dsk/c0t0d0s7
 945          zonecfg:myzone3:fs> set raw=/dev/rdsk/c0t0d0s7
 946          zonecfg:myzone3:fs> set type=ufs
 947          zonecfg:myzone3:fs> end
 948          zonecfg:myzone3> add net
 949          zonecfg:myzone3:net> set address=192.168.0.1/24
 950          zonecfg:myzone3:net> set physical=eri0
 951          zonecfg:myzone3:net> end
 952          zonecfg:myzone3> add net
 953          zonecfg:myzone3:net> set address=192.168.1.2/24
 954          zonecfg:myzone3:net> set physical=eri0
 955          zonecfg:myzone3:net> end
 956          zonecfg:myzone3> add net
 957          zonecfg:myzone3:net> set address=192.168.2.3/24
 958          zonecfg:myzone3:net> set physical=eri0
 959          zonecfg:myzone3:net> end
 960          zonecfg:my-zone3> set cpu-shares=5
 961          zonecfg:my-zone3> add capped-memory
 962          zonecfg:my-zone3:capped-memory> set physical=50m
 963          zonecfg:my-zone3:capped-memory> set swap=100m
 964          zonecfg:my-zone3:capped-memory> end
 965          zonecfg:myzone3> exit
 966 
 967 
 968 
 969        Example 2 Creating a Non-Native Zone
 970 
 971 
 972        The following example creates a new Linux zone:
 973 
 974 
 975          example# zonecfg -z lxzone
 976          lxzone: No such zone configured
 977          Use 'create' to begin configuring a new zone
 978          zonecfg:lxzone> create      -t SUNWlx
 979          zonecfg:lxzone> set zonepath=/export/zones/lxzone
 980          zonecfg:lxzone> set autoboot=true
 981          zonecfg:lxzone> exit
 982 
 983 
 984 
 985        Example 3 Creating an Exclusive-IP Zone
 986 
 987 
 988        The following example creates a zone that is granted exclusive access
 989        to bge1 and bge33000 and that is isolated at the IP layer from the
 990        other zones configured on the system.
 991 
 992 
 993 
 994        The IP addresses and routing is configured inside the new zone using
 995        sysidtool(1M).
 996 
 997 
 998          example# zonecfg -z excl
 999          excl: No such zone configured
1000          Use 'create' to begin configuring a new zone
1001          zonecfg:excl> create
1002          zonecfg:excl> set zonepath=/export/zones/excl
1003          zonecfg:excl> set ip-type=exclusive
1004          zonecfg:excl> add net
1005          zonecfg:excl:net> set physical=bge1
1006          zonecfg:excl:net> end
1007          zonecfg:excl> add net
1008          zonecfg:excl:net> set physical=bge33000
1009          zonecfg:excl:net> end
1010          zonecfg:excl> exit
1011 
1012 
1013 
1014        Example 4 Associating a Zone with a Resource Pool
1015 
1016 
1017        The following example shows how to associate an existing zone with an
1018        existing resource pool:
1019 
1020 
1021          example# zonecfg -z myzone
1022          zonecfg:myzone> set pool=mypool
1023          zonecfg:myzone> exit
1024 
1025 
1026 
1027 
1028        For more information about resource pools, see pooladm(1M) and
1029        poolcfg(1M).
1030 
1031 
1032        Example 5 Changing the Name of a Zone
1033 
1034 
1035        The following example shows how to change the name of an existing zone:
1036 
1037 
1038          example# zonecfg -z myzone
1039          zonecfg:myzone> set zonename=myzone2
1040          zonecfg:myzone2> exit
1041 
1042 
1043 
1044        Example 6 Changing the Privilege Set of a Zone
1045 
1046 
1047        The following example shows how to change the set of privileges an
1048        existing zone's processes will be limited to the next time the zone is
1049        booted. In this particular case, the privilege set will be the standard
1050        safe set of privileges a zone normally has along with the privilege to
1051        change the system date and time:
1052 
1053 
1054          example# zonecfg -z myzone
1055          zonecfg:myzone> set limitpriv="default,sys_time"
1056          zonecfg:myzone2> exit
1057 
1058 
1059 
1060        Example 7 Setting the zone.cpu-shares Property for the Global Zone
1061 
1062 
1063        The following command sets the zone.cpu-shares property for the global
1064        zone:
1065 
1066 
1067          example# zonecfg -z global
1068          zonecfg:global> set cpu-shares=5
1069          zonecfg:global> exit
1070 
1071 
1072 
1073        Example 8 Using Pattern Matching
1074 
1075 
1076        The following commands illustrate zonecfg support for pattern matching.
1077        In the zone flexlm, enter:
1078 
1079 
1080          zonecfg:flexlm> add device
1081          zonecfg:flexlm:device>      set match="/dev/cua/a00[2-5]"
1082          zonecfg:flexlm:device>      end
1083 
1084 
1085 
1086 
1087        In the global zone, enter:
1088 
1089 
1090          global# ls /dev/cua
1091          a     a000  a001  a002  a003  a004  a005  a006  a007  b
1092 
1093 
1094 
1095 
1096        In the zone flexlm, enter:
1097 
1098 
1099          flexlm# ls /dev/cua
1100          a002  a003  a004  a005
1101 
1102 
1103 
1104        Example 9 Setting a Cap for a Zone to Three CPUs
1105 
1106 
1107        The following sequence uses the zonecfg command to set the CPU cap for
1108        a zone to three CPUs.
1109 
1110 
1111          zonecfg:myzone> add capped-cpu
1112          zonecfg:myzone>capped-cpu> set   ncpus=3
1113          zonecfg:myzone>capped-cpu>capped-cpu> end
1114 
1115 
1116 
1117 
1118        The preceding sequence, which uses the capped-cpu property, is
1119        equivalent to the following sequence, which makes use of the zone.cpu-
1120        cap resource control.
1121 
1122 
1123          zonecfg:myzone> add rctl
1124          zonecfg:myzone:rctl> set name=zone.cpu-cap
1125          zonecfg:myzone:rctl> add value      (priv=privileged,limit=300,action=none)
1126          zonecfg:myzone:rctl> end
1127 
1128 
1129 
1130        Example 10 Using kstat to Monitor CPU Caps
1131 
1132 
1133        The following command displays information about all CPU caps.
1134 
1135 
1136          # kstat -n /cpucaps/
1137          module: caps                            instance: 0
1138          name:   cpucaps_project_0               class:    project_caps
1139                  above_sec                       0
1140                  below_sec                       2157
1141                  crtime                          821.048183159
1142                  maxusage                        2
1143                  nwait                           0
1144                  snaptime                        235885.637253027
1145                  usage                           0
1146                  value                           18446743151372347932
1147                  zonename                        global
1148 
1149          module: caps                            instance: 0
1150          name:   cpucaps_project_1               class:    project_caps
1151                  above_sec                       0
1152                  below_sec                       0
1153                  crtime                          225339.192787265
1154                  maxusage                        5
1155                  nwait                           0
1156                  snaptime                        235885.637591677
1157                  usage                           5
1158                  value                           18446743151372347932
1159                  zonename                        global
1160 
1161          module: caps                            instance: 0
1162          name:   cpucaps_project_201             class:    project_caps
1163                  above_sec                       0
1164                  below_sec                       235105
1165                  crtime                          780.37961782
1166                  maxusage                        100
1167                  nwait                           0
1168                  snaptime                        235885.637789687
1169                  usage                           43
1170                  value                           100
1171                  zonename                        global
1172 
1173          module: caps                            instance: 0
1174          name:   cpucaps_project_202             class:    project_caps
1175                  above_sec                       0
1176                  below_sec                       235094
1177                  crtime                          791.72983782
1178                  maxusage                        100
1179                  nwait                           0
1180                  snaptime                        235885.637967512
1181                  usage                           48
1182                  value                           100
1183                  zonename                        global
1184 
1185          module: caps                            instance: 0
1186          name:   cpucaps_project_203             class:    project_caps
1187                  above_sec                       0
1188                  below_sec                       235034
1189                  crtime                          852.104401481
1190                  maxusage                        75
1191                  nwait                           0
1192                  snaptime                        235885.638144304
1193                  usage                           47
1194                  value                           100
1195                  zonename                        global
1196 
1197          module: caps                            instance: 0
1198          name:   cpucaps_project_86710           class:    project_caps
1199                  above_sec                       22
1200                  below_sec                       235166
1201                  crtime                          698.441717859
1202                  maxusage                        101
1203                  nwait                           0
1204                  snaptime                        235885.638319871
1205                  usage                           54
1206                  value                           100
1207                  zonename                        global
1208 
1209          module: caps                            instance: 0
1210          name:   cpucaps_zone_0                  class:    zone_caps
1211                  above_sec                       100733
1212                  below_sec                       134332
1213                  crtime                          821.048177123
1214                  maxusage                        207
1215                  nwait                           2
1216                  snaptime                        235885.638497731
1217                  usage                           199
1218                  value                           200
1219                  zonename                        global
1220 
1221          module: caps                            instance: 1
1222          name:   cpucaps_project_0               class:    project_caps
1223                  above_sec                       0
1224                  below_sec                       0
1225                  crtime                          225360.256448422
1226                  maxusage                        7
1227                  nwait                           0
1228                  snaptime                        235885.638714404
1229                  usage                           7
1230                  value                           18446743151372347932
1231                  zonename                        test_001
1232 
1233          module: caps                            instance: 1
1234          name:   cpucaps_zone_1                  class:    zone_caps
1235                  above_sec                       2
1236                  below_sec                       10524
1237                  crtime                          225360.256440278
1238                  maxusage                        106
1239                  nwait                           0
1240                  snaptime                        235885.638896443
1241                  usage                           7
1242                  value                           100
1243                  zonename                        test_001
1244 
1245 
1246 
1247        Example 11 Displaying CPU Caps for a Specific Zone or Project
1248 
1249 
1250        Using the kstat -c and -i options, you can display CPU caps for a
1251        specific zone or project, as below. The first command produces a
1252        display for a specific project, the second for the same project within
1253        zone 1.
1254 
1255 
1256          # kstat -c project_caps
1257 
1258          # kstat -c project_caps -i 1
1259 
1260 
1261 
1262 EXIT STATUS
1263        The following exit values are returned:
1264 
1265        0
1266 
1267            Successful completion.
1268 
1269 
1270        1
1271 
1272            An error occurred.
1273 
1274 
1275        2
1276 
1277            Invalid usage.
1278 
1279 
1280 ATTRIBUTES
1281        See attributes(5) for descriptions of the following attributes:
1282 
1283 
1284 
1285 
1286        +--------------------+-----------------+
1287        |  ATTRIBUTE TYPE    | ATTRIBUTE VALUE |
1288        +--------------------+-----------------+
1289        |Interface Stability | Volatile        |
1290        +--------------------+-----------------+
1291 
1292 SEE ALSO
1293        ppriv(1), prctl(1), zlogin(1), kstat(1M), mount(1M), pooladm(1M),
1294        poolcfg(1M), poold(1M), rcapd(1M), rctladm(1M), svcadm(1M),
1295        sysidtool(1M), zfs(1M), zoneadm(1M), priv_str_to_set(3C),
1296        kstat(3KSTAT), vfstab(4), attributes(5), brands(5), fnmatch(5), lx(5),
1297        privileges(5), resource_controls(5), security-flags(5), zones(5)
1298 
1299 
1300        System Administration Guide: Solaris Containers-Resource Management,
1301        and Solaris Zones
1302 
1303 NOTES
1304        All character data used by zonecfg must be in US-ASCII encoding.
1305 
1306 
1307 
1308                                  June 6, 2016                      ZONECFG(1M)