I had to create some containers for developers to do their work. Developers always seem to want root access to a machine. Containers work very nice in this scenario: if a developer messes up his container, I can just clone a new one off a “gold” container. ZFS can be very handy here as well: by installing a container on ZFS filesystem and assigning ZFS quota, you can limit how big the container can grow.

So, first I created a ZFS pool out of two slices on two disks. This is not really recommended way to create ZFS pool. You should really be using two whole disks. And, ignore the fact that those disks both reside on the same controller. Right after that I created dev1 filesystem within the zonepool:

bash-3.00# zpool create -m /export/home/zones zonepool mirror c0t0d0s3 c0t1d0s3
bash-3.00# zfs create zonepool/dev1
bash-3.00# zfs list
NAME               USED  AVAIL  REFER  MOUNTPOINT
zonepool           122K  55.6G  25.5K  /export/home/zones
zonepool/dev1     24.5K  8.00G  24.5K  /export/home/zones/dev1

Next I set ZFS quota on the filesystem to 8GB:

bash-3.00# zfs set quota=8G zonepool/dev1
bash-3.00# zfs get all zonepool/dev1
NAME              PROPERTY       VALUE                       SOURCE
zonepool/dev1     type           filesystem                  -
zonepool/dev1     creation       Fri Jun  4  9:17 2010       -
zonepool/dev1     used           24.5K                       -
zonepool/dev1     available      8.00G                       -
zonepool/dev1     referenced     24.5K                       -
zonepool/dev1     compressratio  1.00x                       -
zonepool/dev1     mounted        yes                         -
zonepool/dev1     quota          8G                          local
zonepool/dev1     reservation    none                        default
zonepool/dev1     recordsize     128K                        default
zonepool/dev1     mountpoint     /export/home/zones/dev1     inherited from zonepool
zonepool/dev1     sharenfs       off                         default
zonepool/dev1     checksum       on                          default
zonepool/dev1     compression    off                         default
zonepool/dev1     atime          on                          default
zonepool/dev1     devices        on                          default
zonepool/dev1     exec           on                          default
zonepool/dev1     setuid         on                          default
zonepool/dev1     readonly       off                         default
zonepool/dev1     zoned          off                         default
zonepool/dev1     snapdir        hidden                      default
zonepool/dev1     aclmode        groupmask                   default
zonepool/dev1     aclinherit     secure                      default
zonepool/dev1     canmount       on                          default
zonepool/dev1     shareiscsi     off                         default
zonepool/dev1     xattr          on                          default

Now, I should mention, that prior to configuring /export/home/zones to reside on ZFS I uninstalled dev1 container which was there previously. So, the container itself was gone, but the system still had knowledge of the container’s configuration. I wrote a post on configuring containers here.

bash-3.00# zoneadm list -cv
ID NAME             STATUS     PATH                           BRAND    IP
0 global           running    /                              native   shared
- dev1             configured /export/home/zones/dev1        native   shared

Since the container was already configured, I went ahead and started installing it:

bash-3.00# zoneadm -z dev1 install
/export/home/zones/dev1 must not be group readable.
/export/home/zones/dev1 must not be group executable.
/export/home/zones/dev1 must not be world readable.
/export/home/zones/dev1 must not be world executable.
could not verify zonepath /export/home/zones/dev1 because of the above errors.
zoneadm: zone dev1 failed to verify
bash-3.00#

Woops, looks like the container directory permissions need some fixing:

bash-3.00# cd /export/home/zones/
bash-3.00# ls -l
total 3
drwxr-xr-x   2 root     sys            2 Jun  3 09:48 dev1
bash-3.00# chmod 700 dev1
bash-3.00# chown root:root dev1

One more try to install the container:

bash-3.00# zoneadm -z dev1 install
Preparing to install zone .
Creating list of files to copy from the global zone.
Copying <2561> files to the zone.
Initializing zone product registry.
Determining zone package initialization order.
Preparing to initialize <1086> packages on the zone.
Initialized <1086> packages on zone.
Zone is initialized.
The file contains a log of the zone installation.

That’s it. After the container install completed, before booting dev1, I stuck the following sysidcfg file into /etc directory of dev1 container:

bash-3.00# more sysidcfg
system_locale=en_US
timezone=US/Central
terminal=vt100
security_policy=NONE
network_interface=primary {
hostname=dev1
}
nfs4_domain=dynamic
name_service=NIS {
domain_name=example.com
name_server=nis1(10.1.1.1)
}

That way I would not be asked any container configuration questions during first container boot. Except for the root password, of course.