Solaris offers a very sophisticated and lightweight method for virtualizing multiple instances of Solaris OS using Zones. Multiple zones can be defined on the host operating system (“which in itself is a zone, called global zone”).
These multiple zones provides isolation, security, between each other and yet are very lightweight. Unlike a traditional virtual machines which requires a complete instance of OS running for each instance, the instances of Zones uses the same running kernel efficiently.
This is one of the major motivation behind this exercise, because the resources required for supporting individual instances are equivalent to the primary application that would be running on these zones. But since there is only one kernel instance interpreting all the system calls, it’s not possible to run instances of other operating systems like Windows XP, Vista, OSX et. al.
However there is an interesting project called “BrandZ” which extends Zones, which allows the use of non-native binaries (os). As of the writing (04/09) Linux Zones works pretty well (I don’t think non Unix OS would be supported anytime soon).
I have been using OpenSolaris based workstation as a feature rich, flexible and stable home NAS for serving iSCSI, SMB, NFS et. al. But there are many applications which are either not supported on Solaris but are under Linux. One such application is a DLNA compliant UPnP server.
In this article I will detail all the steps required to:
- Setup a Fedora-10 based Branded Zone on OpenSolaris 2008.11, And
- Configure “Media-Tomb” for streaming content to a PS3 (DLNA Client)
Setting up a zone is fairly straightforward. The command “zonecfg” is used to create zone by specifying the characteristics of the zone. This command creates an xml file under “/etc/zones” which contains all the details that were entered using “zonecfg”.
Creating The Branded Zone
Step 1: Starting a new configuration.
# zonecfg -z Fedora-10
Fedora-10: No such zone configured
Use 'create' to begin configuring a new zone.
Step 2: Using a template to inherit some basic information. SUNWlx refers to Linux based Branded Zones.
zonecfg:Fedora-10> create -t SUNWlx
Step 3: Specifying the location where the files would be installed. The path need not exist as it would be automatically created in the installation phase with the proper permissions.
zonecfg:Fedora-10> set zonepath=/tank/Zones/Fedora-10
Step 4: Setting the autoboot parameter, if set to true the zone would be started automatically whenever the machine is rebooted.
zonecfg:Fedora-10> set autoboot=true
Step 5: Setting the network parameters. And associating the network IP address with the physical Ethernet NIC. In the example below the physical NIC interface “bge0” would be used for networking. The list of available NIC on the system can be probed by using the command “ifconfig”.
zonecfg:Fedora-10> add net
zonecfg:Fedora-10:net> set address=192.168.0.29/24
zonecfg:Fedora-10:net> set physical=bge0
zonecfg:Fedora-10:net> end
Step 6: Adding a local file system to the zone and providing a mount point within the zone. In the example below the local file system “/tank/Content/Media/Videos” would be mounted within the zone at “/local_zfs_volume”
zonecfg:Fedora-10> add fs
zonecfg:Fedora-10:fs> set dir=/local_zfs_volume
zonecfg:Fedora-10:fs> set special=/tank/Content/Media/Videos
zonecfg:Fedora-10:fs> set type=lofs
zonecfg:Fedora-10:fs> end
Step 7: Setting Linux 2.6 kernel parameter. By default OpenSolaris 2008.11 Zones only support 2.4 kernels. For 2.6 there is a template which could be downloaded inside /etc/zones or the following parameters could be changed from the “zonecfg” interface. I chose the latter:
zonecfg:Fedora-10> add attr
zonecfg:Fedora-10:attr> set name=kernel-version
zonecfg:Fedora-10:attr> set type=string
zonecfg:Fedora-10:attr> set value=2.6
zonecfg:Fedora-10:attr> end
Step 8: Setting the upper limit on the CPU utilization by the zone. The example below would cap the maximum CPU utilization at 50% of one CPU on the physical machine. For example my workstation is a dual core 3.0GHz machine, so effectively in worst case scenario the zone would not be allowed to use more than 1.5GHz of processing power.
zonecfg:Fedora-10> add capped-cpu
zonecfg:Fedora-10:capped-cpu> set ncpus=0.5
zonecfg:Fedora-10:capped-cpu> end
Step 9: Capping the maximum memory. This is also neat since there is no actual kernel running for this virtual machines the footprint is actually the size of the applications running inside the zone. So the memory required for supporting a Zone is pretty less.
zonecfg:Fedora-10> add capped-memory
zonecfg:Fedora-10:capped-memory> set physical=512m
zonecfg:Fedora-10:capped-memory> set swap=512m
zonecfg:Fedora-10:capped-memory> end
Step 10: Finishing the configuration, verifying and saving the new changes.
zonecfg:Fedora-10> commit
zonecfg:Fedora-10> info
zonename: Fedora-10
zonepath: /tank/Zones/Fedora-10
brand: lx
autoboot: true
bootargs:
pool:
limitpriv:
scheduling-class:
ip-type: shared
hostid:
fs:
dir: /local_zfs_volume
special: /tank/Content/Media/Videos
raw not specified
type: lofs
options: []
net:
address: 192.168.0.29/24
physical: bge0
defrouter: 192.168.0.1
capped-cpu:
[ncpus: 0.50]
capped-memory:
physical: 512M
[swap: 512M]
attr:
name: kernel-version
type: string
value: 2.6
rctl:
name: zone.cpu-cap
value: (priv=privileged,limit=50,action=deny)
rctl:
name: zone.max-swap
value: (priv=privileged,limit=536870912,action=deny)
Step 11: Exiting the interface.
zonecfg:Fedora-10> exit
The flexibility of specifying the amount of resource allocated to a zone comes very handy in providing Quality of Service to different zones. And also saves the other zones in case, if there is a rouge process trying to consume all of the resources. And since there is no or very little overhead in creating/managing a zone itself it might be a good idea to run several application like Web Server, MySQL, Media Server, et. al. in their own separate zones 
With the help of capped-cpu and memory constructs one zone could be heavily thrashing it’s share of resource without even affecting the process on the other zones.
Now that we have the Zone defined it’s time to perform the actual installation inside this Branded Zone.
Installing BrandZ: Linux (Fedora-10)
Linux OS can be installed on a Branded Zone using two methods:
- Using the installer CD/DVD/ISO
- Using a “tarball” of an installed system
I chose the second option as there are known issues with the first option, and only selected few distributions are known to work. So I created a virtual machine on my “vmware” workstation, installed Fedora-10_i386, and created a tarball using the following command:
# cd /
# tar -jcf fedora-10.tar.bz2 --exclude fedora-10.tat.bz2 \
--exclude dev --exclude proc --exclude sys --exclude boot *
Remember to unmount any NFS or CIFS share, if you are planning to create a tarball of an existing installation. I have also made the tarball available for download from here [ http://www.abisen.com/pub/fedora-10-brandZ/fedora10.tar.bz2 ].
You’ll also notice that we are excluding all of the device, kernel and sys directories, validating that there won’t be any separate instance of an OS running, only the applications and the system call’s would be interpreted and serviced by the solaris kernel.
These are the steps that I took for installing the linux tarball on my Branded Zone.
Step 1: Installing the OS from the tarball inside the newly created Zone.
# zoneadm -z Fedora-10 install -d /tmp/fedora10.tar.bz2
A ZFS file system has been created for this zone.
Installing zone 'Fedora-10' at root directory '/tank/Zones/Fedora-10'
from archive '/tmp/fedora10.tar.bz2'
This process may take several minutes.
Setting up the initial lx brand environment.
System configuration modifications complete.
Setting up the initial lx brand environment.
System configuration modifications complete.
Installation of zone 'Fedora-10' completed successfully.
Details saved to log file:
"/tank/Zones/Fedora-10/root/var/log/Fedora-10.install.1075.log"
Note: The above command would also create a new ZFS file system with appropriate permissions.
Step 2: Verify the presence of the newly created zone and all the other installed zones and their current state
# zoneadm list -iv
ID NAME STATUS PATH BRAND IP
0 global running / native shared
2 Fedora-9 running /tank/Zones/Fedora-9 lx shared
3 Fedora-10 installed /tank/Zones/Fedora-10 lx shared
- centos52 installed /tank/Zones/centos52 lx shared
Step 3: Booting the newly installed zone. One handy tip is to open a new terminal instance and connect to the console of the installed zone “Fedora-10” using the command “zlogin -C Fedora-10”. This would act as a monitor for all the activities taking place inside the zone while it’s booting up. Following screenshot shows that I mean:
# zoneadm -z Fedora-10 boot
Step 4: Logging into the zone. Also notice that the console of my installation is clean and there are no error messages. In reality the first time you boot there would be many error messages. Which we will fix in the later steps. The following command would get us logged into a terminal session of the zone.
# zlogin Fedora-10
Step 5: In this step we will clean the installation for error free bootup. Also I noticed that for some reason the startup scripts are not getting executed in my installation. Which is fine as one of the positive side effect is that unnecessary services are not started by default :).
So upon further investigation it was found that the culprit for all the error message during bootup were also the init scripts (actually one script in particular: “/etc/rc.d/rc.sysinit”). I won’t go in detail but there were a lot of reference to /dev/urandom, loadable modules for device-mapper et. al. which are not eactly required in a Branded Zone (remember no kernel only applications). So I cleaned my /etc/rc.d/rc.sysinit and at the end I am also using this script to call all the other services that I would like to start during boot sequence.
My modified scrip can be downloaded from the following location [ http://www.abisen.com/pub/rc.sysinit ].
Step 6: Configuring the yum with the rpmfusion [ www.rpmfusion.org ] repository and updating the system.
# rpm -Uvh http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-stable.noarch.rpm \
http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-stable.noarch.rpm
# yum update
# yum install media-tomb ffmpeg mplayer vlc-nox
Step 7: Modifying the startup script for media-tomb. The ethernet interface is a fake interface which is basically tied up to the global zone’s NIC. And there is no kernel/os running so some interfaces don’t respond the way they are supposed to in a real environment. And this prevents the media tomb to probe the ethernet nice (in my case bge0). So I modified the file “/etc/mediatomb.conf”, kept everything same but added the following line:
IFACE_IP="192.168.0.29"
And modified the startup by modifying the following lines:
# [ ${NETWORKING} = "no" ] && exit 0
daemon $NICELEVEL mediatomb $MEDIATOMB -i $IFACE_IP $MT_OPTIONS
My version of media tomb startup script can be downloaded from [ http://www.abisen.com/pub/mediatomb ]
Step 8: This sets everything in order for running media tomb. The interface can be accessed using http://IP(of the zone):50500.
In the next part I will talk about customization of media-tomb such that it could be used for real-time transcoding of the format’s that a UPnP player does not understands natively.
