In Solaris 11 we introduced Immutable Zones. In Solaris 11.2 we added the Immutable Global Zone. Please read my earlier blog if you are unfamiliar with Immutable Zones.
When a Solaris system reboots after the system was just installed
or upgraded, self assembly is performed. This phase requires the system
to be read-write, even when it is an immutable (global) zone. All services which require self-assembly specify that the self-assembly-complete milestone is dependent on them. When the self-assembly-complete milestone is
reached, the system reboots immutable.
As the self-assembly-complete milestone isn't reached until
man-index and several other service have run their course, the second
boot may come quite a bit later. Use: the following command to list all
# svcs -d self-assembly-complete
The self-assembly-service itself reboots the system; for non-global
zones this is pretty quick but for global zones this can be pretty
slow. We have always found this a bug rather than a feature so we
decided to fix that for the next Solaris release. Of course, if
self-assembly needs to wait for man-index and other services to
complete, not requiring a reboot was only a small part of the puzzle we
needed to solve.
In Solaris 11.2 with the design of the immutable global zone, we
created the Trusted Path. Processes which run under the Trusted Path
can modify files which are normally read-only in immutable zones. While
this feature was invented to allow modification and updates of an
Immutable Global Zone as well as modifications to non-global Immutable
Zones using the zlogin -T or -U options, we realized that this could be
used to do certain self-assembly operations asynchronously. Asynchronous
updates would be interrupted if we rebooted so we needed to fix both
problems at the same time.
We implemented this in the next Solaris release and one of our
customers who got earlier access to that release filed a service request
for a back port of that feature and the rest is history.
We introduce a new milestone. immutable-setup, which is reached
early during boot and sets the zone's file-mac-profile. Services which
need to know whether the system is immutable need to wait until that
milestone is reached. For native zones this is already done by zoneadmd
before starting the zone.
When the self-assembly-complete milestone is reached, the zone will
become immutable at that time. In earlier releases of Solaris a reboot
[NOTICE: This read-only system transiently booted read/write]
[NOTICE: Now that self assembly has been completed, the system is rebooting]
as of Solaris 11.3 SRU 12 you will see:
[NOTICE: switching to read-only mode]
and the system will continue while man-index asynchronously continues to format manual pages.
But that is not all! It is now much easier to configure an immutable global zone and, again, without requiring a reboot:
# zonecfg -z global set file-mac-profile=<profile>
# zoneadm -z global apply
You will see the same message on /dev/console