The third time you do something, you automate it. I’ve been building a lot of
zones lately.
Advance Wars ain’t gonna play itself
Creating a zone is straightforward, but can take a while:
- get an IP and hostname reserved for it
- configure a new zone (where to put it, IP address, etc.)
- install it
- boot it
- give sysidconfig information (root pass, DNS setup, terminal type, timezone, etc.)
- go in and customize it (setup RSA keys, disable services, etc.)
- install whatever I wanted the zone for in the first place
sysidconfig and customizing the zone are the most involved (and error prone) steps.
All my zones are configured identically (same DNS servers etc) so
I’ll build a template zone tweaked to my ‘standard build’ and
clone zones from it .
This avoids a (slow) install, instead copying the ‘parent’ zonepath to the clones zonepath.
More importantly, any customizations made to the template will be present in the clones.
sysidconfig can be fed a sysidcfg
file (which contains answers to the setup questions) – we’ll do that too.
the mother of all zones
The first thing to do is build the template zone and customize it. Time spent on this step will be time saved later, so anything that makes life easier should go in.
First we do a standard zone config (each clone zone gets its own config later)
vera # zonecfg -z template
create
set zonepath=/zones/template
set autoboot=false
add net
set physical=iprb0
set address=1.2.3.4/17
end
commit
exit
vera # zoneadm -z template installNext, login and customize the zone.
vera # zoneadm -z template boot
vera # zlogin -C -e ^ templateMy checklist is:
- change roots shell to zsh and home dir to /root
- make roots home directory
- give root a sane prompt and a decent pager
- copy my pubkey into /root/.ssh
- enable tcp port forwarding, rsa ssh logins only for root
- set up sendmail smarthost and aliases
Since I did all this for my glassfish zone
the other day, I can just copy config files from that:
vera # cp /zones/goldfish/root/etc/passwd /zones/template/root/etc/passwd
vera # mkdir /zones/template/root/root
vera # cp -Rp /zones/goldfish/root/root/.bash_profile /zones/template/root/root/
vera # cp -Rp /zones/goldfish/root/root/.ssh/ /zones/template/root/root/.
vera # cp /zones/goldfish/root/etc/ssh/sshd_config /zones/template/root/etc/ssh/sshd_config
vera # cp /zones/goldfish/root/etc/mail/sendmail.cf /zones/template/root/etc/mail/sendmail.cf
vera # cp /zones/goldfish/root/etc/mail/aliases /zones/template/root/etc/mail/aliases
vera # cp /zones/goldfish/root/etc/mail/aliases.db /zones/template/root/etc/mail/aliases.dban answer for everything
All my zones:
- have the same DNS config
- have the root password disabled (I login with ssh RSA keys or with zlogin)
- don’t need the network interface setup (since they’re zones)
The only thing that changes between zones is their hostname (‘ZONENAME’) which I’ll change
when I copy my sysidcfg template
into the zones /etc directory.
the payoff
Given the zone name and the IP of its interface, you can bang out zones in around 10 seconds with a ten-line shell script
vera # time /zones/bang_one_out.sh goldfish 1.2.3.4/24
Cloning snapshot tank/zones/template@SUNWzone1
Instead of copying, a ZFS clone has been created for this zone.
ID NAME STATUS PATH BRAND IP
0 global running / native shared
6 goldfish running /zones/goldfish native shared
- template installed /zones/template native shared
real 0m8.593s
user 0m0.229s
sys 0m0.397sThat’s 9 seconds to configure, build and boot a zone to a state where you can SSH in as root – all services done, ssh keys generated, etc.
To be fair, /zones being on ZFS speeds things up tremendously (using ZFS clones for the copy). But not having to copy keys, edit ssh/sendmail/passwd configs is very nice.
feeping creaturism
It’s tempting to add to the script, add resource controls etc. (some semblance of fricking argument checking probably wouldn’t kill me) but there’s a project by much
smarter people doing that already.
Zone Manager
is the swiss army knife of zone administration.
I find the number of options a bit overwhelming myself, but
take a look if you’re in search of a good CLI tool for zone administration.
I’ve since