Working with Non-Global Zones

You can use most IPS commands in a non-global zone the same way you use them in the global zone. Note that Oracle Solaris 10 branded zones are different from Oracle Solaris 11 non-global zones. IPS commands ignore Oracle Solaris 10 branded zones. In this book, “non-global zone” means Oracle Solaris 11 non-global zone.

An important difference between the global zone and non-global zones is the use of package publishers. In a non-global zone, the system repository provides access to the package repositories configured in the global zone. Publisher configuration changes made to the global zone are seen immediately by all non-global zones via the system repository.

Installing Packages in Non-Global Zones

Non-global zones can be affected by installing, updating, and uninstalling packages in the global zone. When you run the pkg update command with no arguments in the global zone, the global zone and each non-global zone is updated. See Updating Multiple Non-Global Zones Concurrently for an example. When you specify package names with the install, update, or uninstall commands in the global zone, IPS checks each non-global zone and makes changes only if required to keep the non-global zone compatible with the global zone. Changing facets and variants in the global zone can also affect non-global zones.

When you run package commands while logged into a non-global zone, only that non-global zone is affected. You can install different packages and install different versions of the same package if the result is compatible with the global zone. You can avoid different packages, freeze packages at different versions, set mediators to select different default implementations, and set different facets in the non-global zone image.

Versions of packages installed in a non-global zone can be restricted by the versions installed in the global zone. Some packages cannot be updated or downgraded in a non-global zone because those packages must be the same version in the non-global zone as they are in the global zone. For example, the package named entire must be the same in each non-global zone as in the global zone. The entire package constrains system package versions so that the resulting set of packages is a supportable image.

In a non-global zone, the system repository provides access to the package repositories configured in the global zone. Publisher configuration changes made to the global zone are seen immediately by all non-global zones via the system repository. The system repository will proxy http, https, and v4 file repositories and .p5p archive repositories.

The zones proxy is a service that enables pkg commands running inside a zone to communicate with the system repository, which is running in the global zone. The zones proxy has two parts. The following service runs in the global zone:

svc:/application/pkg/zones-proxyd:default

The following service runs in the non-global zone:

svc:/application/pkg/zones-proxy-client:default

See the pkg.sysrepo(1M) man page for more information about the system repository and zones proxy services.

The following example shows publishers in a global zone:

global:~$ pkg publisher
PUBLISHER             TYPE     STATUS P LOCATION
solaris               origin   online F http://pkg.oracle.com/solaris/release/
solaris               origin   online F file:///export/repoSolaris11/
devtool  (disabled)   origin   online F http://pkg.example1.com/
isvpub                origin   online F http://pkg.example2.com/

The following example shows how these same publishers appear when you are logged into a non-global zone:

z1:~$ pkg publisher
PUBLISHER             TYPE     STATUS P LOCATION
solaris  (syspub)     origin   online T <system-repository>
solaris  (syspub)     origin   online F <system-repository>
isvpub   (syspub)     origin   online F <system-repository>

The T in the P column means this origin has a proxy. Use either of the following commands to get more information:

z1:~$ pkg publisher -F tsv
PUBLISHER  STICKY  SYSPUB  ENABLED  TYPE    STATUS  URI                                     PROXY
solaris    true    true    true     origin  online  http://pkg.oracle.com/solaris/release/  http://localhost:1008
solaris    true    true    true     origin  online  http://localhost:1008/solaris/omitted/    -
z1:~$ pkg publisher solaris
            Publisher: solaris
                Alias:
           Origin URI: http://localhost:1008/solaris/91b04f12f39930ae8e27f5636b7a342e8f460133/
              SSL Key: None
             SSL Cert: None
           Origin URI: http://pkg.oracle.com/solaris/release/
                Proxy: http://localhost:1008
              SSL Key: None
             SSL Cert: None
          Client UUID: c92e7a92-dce5-11e1-b7e5-8800209e4377
      Catalog Updated: August  2, 2012 05:10:48 PM
              Enabled: Yes

You cannot reconfigure the system repository from within a non-global zone. For example, you cannot change the origins or properties of publishers or the publisher search order of publishers whose location is <system-repository>.

If you cannot reach a publisher, you can set a proxy in the global zone by setting the http_proxy environment variable or by specifying the --proxy option to the pkg set-publisher command. See the pkg(1) man page and Adding, Modifying, or Removing Package Publishers for information about the --proxy option. See Proxy Configuration on a System That Has Installed Zones in Oracle Solaris 11.1 Administration: Oracle Solaris Zones, Oracle Solaris 10 Zones, and Resource Management for instructions for setting the http_proxy and https_proxy environment variables. See the ENVIRONMENT section of the curl(1) man page for additional information about proxy environment variables.

To list packages from a specific publisher that is already configured in the global zone, the following format gives the same result in the both the global zone and non-global zones:

z1:~$ pkg list -a '//isvpub/*'
NAME (PUBLISHER)    VERSION    IFO
isvtool (isvpub)    1.0-0      ---

For repositories that are not configured in the global zone, but that are network or filesystem-accessible to the non-global zone, both of the following commands list the same packages if file:///export/myrepo is a repository location that is accessible to the non-global zone:

z1:~$ pkg list -af -g file:///export/myrepo
z1:~$ pkgrepo list -s file:///export/myrepo

Updating Multiple Non-Global Zones Concurrently

By default, when you use the pkg update command in the global zone, the packaging system updates the global zone and each non-global zone serially. To update multiple non-global zones concurrently, use the -C option or set the PKG_CONCURRENCY environment variable in the global zone. The -C n option and the PKG_CONCURRENCY=n environment variable specify to update at most n images in parallel for n greater than or equal to 1. The default value of n is 1. If n is 0 or a negative number, all non-global zones are updated in parallel with the global zone.

The PKG_CONCURRENCY environment variable is ignored if the -C option is specified. The -C option and the PKG_CONCURRENCY environment variable can be used with pkg install, pkg uninstall, pkg change-variant, and pkg change-facet as well as with pkg update.

Non-global zones do not need to be booted to be updated from the global zone. The non-global zones only need to be mounted.

In the following example, both non-global zones are updated at the same time as the global zone:

global:~$ pfexec pkg update -C 0 --be-name s11u1
 Startup: Linked image publisher check ... Done
 Startup: Refreshing catalog 'solaris' ... Done
 Startup: Refreshing catalog 'isvpub' ... Done
 Startup: Checking that pkg(5) is up to date ... Done
Planning: Solver setup ... Done
Planning: Running solver ... Done
Planning: Finding local manifests ... Done
Planning: Package planning ... Done
Planning: Merging actions ... Done
Planning: Checking for conflicting actions ... Done
Planning: Consolidating action changes ... Done
Planning: Evaluating mediators ... Done
Planning: Planning completed in 39.00 seconds
            Packages to remove:   2
           Packages to install:   1
            Packages to update: 640
       Create boot environment: Yes
Create backup boot environment:  No

Planning: Linked images: 0/2 done; 2 working: zone:z1 zone:z2
Planning: Linked image 'zone:z1' output:
| Packages to install:   1
|  Packages to update: 161
|  Services to change:   2
`
Planning: Linked images: 1/2 done; 1 working: zone:z2
Planning: Linked image 'zone:z2' output:
| Packages to install:   1
|  Packages to update: 161
|  Services to change:   2
`
Planning: Finished processing linked images.
Download:     0/12068 items    0.0/350.9MB  0% complete
...
Download: 11664/12068 items  336.1/350.9MB  95% complete
Download: Completed 350.91 MB in 187.08 seconds (0B/s)
Download: Linked images: 0/2 done; 2 working: zone:z1 zone:z2
Download: Linked images: 1/2 done; 1 working: zone:z1
Download: Finished processing linked images.
 Actions:     1/23382 actions (Removing old actions)
 Actions:  3867/23382 actions (Installing new actions)
 Actions:  8192/23382 actions (Updating modified actions)
...
 Actions: 23266/23382 actions (Updating modified actions)
 Actions: Completed 23382 actions in 96.16 seconds.
Finalize: Updating package state database ...  Done
Finalize: Updating package cache ...  Done
Finalize: Updating image state ...  Done
Finalize: Creating fast lookup database ...  Done
Finalize: Reading search index ...  Done
Finalize: Building new search index ...  Done
Finalize: Linked images: 0/2 done; 2 working: zone:z1 zone:z2
Finalize: Linked images: 1/2 done; 1 working: zone:z2
Finalize: Finished processing linked images.

A clone of s11 exists and has been updated and activated.
On the next boot the Boot Environment s11u1 will be
mounted on '/'.  Reboot when ready to switch to this updated BE.