Setting Zone-Wide Resource Controls

Language:

Resource controls are specified for both the global and non-global zones by using the zonecfg command.

Zone-wide resource controls limit the total resource usage of all process entities within a zone. For a complete list, see the resource-controls(7) man page. For zone-specific resources, search for "zone" in the man page.
An administrator with the appropriate rights can set zone-wide resource controls for a zone. For information about rights, see Using Rights Profiles to Install and Manage Zones in Creating and Using Oracle Solaris Zones.

Tip - For ease of administration, set the resource control as a zone resource property, such as capped-cpu, rather than the equivalent resource control, such as zone.cpu-cap.

zone.cpu-cap resource control – Sets an absolute limit on the amount of CPU resources that can be consumed by a zone. A value of 100 means 100 percent of one CPU as the setting. A value of 125 is 125 percent, because 100 percent corresponds to one full CPU on the system when using CPU caps.

See also capped-cpu Resource Type.
zone.cpu-shares resource control – Global scope. Sets a limit on the number of fair share scheduler (FSS) CPU shares for a zone. CPU shares are first allocated to the zone, and then further subdivided among projects within the zone as specified in the project.cpu-shares entries. For more information, see Using the Fair Share Scheduler on a System With Zones Installed in Creating and Using Oracle Solaris Zones. The global property name for this control is cpu-shares.

See also cpu-shares Global Property.
zone.max-adi-metadata-memory resource control – Global scope. Controls the maximum amount of metadata allocated for Silicon Secured Memory (SSM) enabled pageable memory. SSM is includes ADI.

See also max-adi-metadata-memory Global Property.
zone.max-locked-memory resource control – Limits the amount of locked physical memory available to a non-global zone. The allocation of the locked memory resource across projects within the zone can be controlled by using the project.max-locked-memory resource control.

Tip - If priv_proc_lock_memory is assigned to a zone, consider setting this resource control as well, to prevent that zone from locking all memory.

For more information, see Available Resource Controls in Administering Resource Management in Oracle Solaris 11.4 and the locked property in capped-memory Resource Type.
zone.max-lofi resource control – Limits the number of potential lofi devices that can be created by a zone.

See also max-lofi Global Property.
zone.max-lwps resource control – Global scope. Enhances resource isolation by preventing too many LWPs in one zone from affecting other zones. The allocation of the LWP resource across projects within the zone can be controlled by using the project.max-lwps resource control. See Available Resource Controls in Administering Resource Management in Oracle Solaris 11.4 for more information.

See also max-lwps Global Property.
zone.max-processes resource control – Global scope. Enhances resource isolation by preventing a zone from using too many process table slots and thus affecting other zones. The allocation of the process table slots resource across projects within the zone can be set by using the project.max-processes resource control described in Available Resource Controls in Administering Resource Management in Oracle Solaris 11.4. The global property name for this control is max-processes. The zone.max-processes resource control can also encompass the zone.max-lwps resource control. If zone.max-processes is set and zone.max-lwps is not set, then zone.max-lwps is implicitly set to 10 times the zone.max-processes value when the zone is booted.

Note - Because both normal processes and zombie processes take up process table slots, the max-processes control thus protects against zombie processes exhausting the process table. Because zombie processes do not have any LWPs by definition, the max-lwps cannot protect against this possibility.

See also max-processes Global Property.
zone.max-msg-ids resource control – Global scope. And zone.max-sem-ids, zone.max-shm-ids, and zone.max-shm-memory resource controls are used to limit System V resources used by all processes within a zone. The allocation of System V resources across projects within the zone can be controlled by using the project versions of these resource controls. The equivalent global property names for these controls are max-msg-ids, max-sem-ids, max-shm-ids, and max-shm-memory, respectively.
zone.max-swap resource control – Limits swap consumed by user process address space mappings and tmpfs mounts within a zone. The output of the prstat -Z command displays a SWAP column. The swap reported is the total swap consumed by the processes of the zone and tmpfs mounts. This value assists in monitoring the swap reserved by each zone, which can be used to choose an appropriate zone.max-swap setting.

See also the swap property in capped-memory Resource Type.

You can specify these resource controls on running processes by using the prctl command. An example is provided in How to Temporarily Set FSS Shares in the Global Zone in Creating and Using Oracle Solaris Zones. However, controls set by using prctl do not persist across system reboot.