Administering Read-Only Zones

The on-disk configuration can be administered only from the global zone. Within the running zone, administration is limited to setting the runtime state, unless the zone has been booted writable. Thus, configuration changes made through the SMF commands described in the svcadm(1M) and svccfg(1M) man pages are only applicable to the temporary, live SMF database, not to the on-disk SMF database. Modifications made to the zone's MWAC configuration take effect when the zone is rebooted.

At initial installation or after updates, the zone boots transient read-write until it reaches the self-assembly-complete milestone. The zone then reboots in read—only mode.

zoneadm list -p Display

The parsable output displays an R/W column, and a file-mac-profile column:

global# zoneadm list -p
0:global:running:/:UUID:solaris:shared:-:none
    5:testzone2:running:/export/zones/testzone2:UUID \
        :solaris:shared:R:fixed-configuration
    12:testzone3:running:/export/zones/testzone3:UUID \
        :solaris:shared:R:fixed-configuration
    13:testzone1:running:/export/zones/testzone1:UUID \
        :solaris:excl:W:fixed-configuration
    -:testzone:installed:/export/zones/testzone:UUID \
        :solaris:excl:-:fixed-configuration

    

The following R and W options are defined:

• R indicates a zone with a file-mac-profile that is booted read-only.

• W indicates a zone with a file-mac-profile that is booted read-write.

• — indicates that a zone is either not running or has no file-mac-profile.

Options for Booting a Read-Only Zone With a Writable Root File System

The zoneadm boot subcommand provides two options that allow the global zone administrator to manually boot a read-only zone with either a writable root file system or with a transient writable root file system. Note that the zone will be in writable mode only until the next reboot occurs.

-w

Manually boot the zone with a writable root file system.

-W

Manually boot the zone with a transient writable root file system. The system is rebooted automatically when the self-assembly-complete milestone is reached.

The reboot places the zone under control of the MWAC policy again. This option is permitted when the zone has an MWAC policy of none.

Both the -W and -w options are ignored for non-ROZR zones.