News, tips, partners, and perspectives for Oracle’s virtualization offerings

Solaris 10 branded zone VM Templates for Solaris 11 on OTN

Jeff Savit
Product Management Senior Manager

Early this year I wrote the article
Ours Goes To 11
which describes the ability to import Solaris 10 systems into a "Solaris 10 branded zone" under Oracle Solaris 11.
I did this using Solaris 11 Express, and the capability remains in Solaris 11 with only slight changes.
This important tool lets you painlessly inhaling a Solaris Container from Solaris 10 or entire Solaris 10 systems ("the global zone") into virtualized environments on a Solaris 11 OS.

Just recently, Oracle provided Oracle VM Templates for Oracle Solaris 10 Zones to let you create Solaris 10
branded zones for Solaris 11 even if you don't currently have access to install media or a running Solaris 10 system.
To use this, just download the Oracle VM Template for Oracle Solaris Zone 10 from OTN at
This page contains images of Oracle Solaris 10 8/11 (the recent update to Solaris 10) in SPARC and x86 formats
suitable for creating branded zones.
The same page also has a VirtualBox image you can download for a complete Solaris 10 install in a guest virtual machine you can run on any host OS that supports VirtualBox.
Both sets of downloads provide a quick - and extremely easy - way to set up a virtual Solaris 10 environment.
In the case of the Oracle VM Templates, they illustrate several advanced features of Solaris 11.

To start, just go to the above link, download the template for the hardware platform (SPARC or x86) you want,
and download the README file also linked from that page.

Install prerequisites

The README file tells you to install the prerequisite Solaris 11 package that implements the Solaris 10 brand.
Then you can install instances of zones with that brand.

# pkg install pkg:/system/zones/brand/brand-solaris10
Packages to install: 1
Create boot environment: No
Create backup boot environment: Yes
Completed 1/1 44/44 0.4/0.4
Install Phase 74/74
Package State Update Phase 1/1
Image State Update Phase 2/2

That took only a few minutes, and didn't require a reboot.

Install the Solaris 10 zone

Now it's time to run the downloaded template file.
First make it executable via the chmod command, of course.
I found that (unlike stated in the README) there was no need to rename the downloaded file to remove the
When you run it you provide several parameters to describe the zone configuration:

  • -a IP address - the IP address and optional netmask for the zone. This is the only mandatory parameter.
  • -z zonename - the name of the zone you would like to create.
  • -i interface - the package will create an exclusive-IP zone using a virtual NIC (vnic)
    based on this physical interface. In my case, I have a NIC called rge0.
  • -p PATH - specifies the path in which you want the zoneroot to be placed. In my case,
    I have a ZFS dataset mounted at /zones, and this will create a zoneroot at /zones/s10u10.

Kicking it off, you will see a copyright message, and then messages showing progress building the zone,
which only takes a few minutes.
# ./solaris-10u10-x86.bin -p /zones -a -i rge0 -z s10u10
Checking disk-space for extraction
Extracting in /export/home/CDimages/s10zone/bootimage.ihaqvh ...
100% [===============================>]
Checking data integrity
Checking platform compatibility
The host and the image do not have the same Solaris release:
host Solaris release: 5.11
image Solaris release: 5.10
Will create a Solaris 10 branded zone.
Warning: could not find a defaultrouter
Zone won't have any defaultrouter configured
IMAGE: ./solaris-10u10-x86.bin
ZONE: s10u10
ZONEPATH: /zones/s10u10
VNIC: vnicZBI13379
MAC ADDR: 2:8:20:5c:1a:cc
Checking disk-space for installation
Installing in /zones/s10u10 ...
100% [===============================>]
Using a static exclusive-IP
Attaching s10u10
Booting s10u10
Waiting for boot to complete
Zone s10u10 booted
The zone's root password has been set using the
root password of the local host.
You can change the zone's root password to
further harden the security of the zone: being
root, log into the zone from the local host
with the command 'zlogin s10u10'.
Once logged in, change the root password with the
command 'passwd'.

The nifty part in my opinion (besides being so easy),
is that the zone was created as an exclusive-IP zone on a virtual NIC.
This network configuration lets you enforce traffic isolation from other zones,
enforce network Quality of Service, and even let the zone set its own characteristics
like IP address and packet size.

Independence of the zone's network characteristics
from the global zone is one of the enhancements in Solaris 10 that make it easier to consolidate
zones while preserving their autonomy, yet provide control in a consolidated environment.

Let's see what the virtual network environment looks like by issuing commands
from the Solaris 11 global zone. First I'll use Old School ifconfig, and then
I'll use the new ipadm and dladm commands.

# ifconfig -a4
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index 1

inet netmask ff000000
rge0: flags=1004943<UP,BROADCAST,RUNNING,PROMISC,MULTICAST,DHCP,IPv4> mtu 1500 index 2

inet netmask ffffff00 broadcast

ether 0:14:d1:18:ac:bc
vboxnet0: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 3

inet netmask ffffff00 broadcast

ether 8:0:27:f8:62:1c
# dladm show-phys
yge0 Ethernet unknown 0 unknown yge0
yge1 Ethernet unknown 0 unknown yge1
rge0 Ethernet up 1000 full rge0
vboxnet0 Ethernet up 1000 full vboxnet0
# dladm show-link
yge0 phys 1500 unknown --
yge1 phys 1500 unknown --
rge0 phys 1500 up --
vboxnet0 phys 1500 up --
vnicZBI13379 vnic 1500 up rge0
s10u10/vnicZBI13379 vnic 1500 up rge0
s10u10/net0 vnic 1500 up rge0
# dladm show-vnic
vnicZBI13379 rge0 1000 2:8:20:5c:1a:cc random 0
s10u10/vnicZBI13379 rge0 1000 2:8:20:5c:1a:cc random 0
s10u10/net0 rge0 1000 2:8:20:9d:d0:79 random 0
# ipadm show-addr
lo0/v4 static ok
rge0/_a dhcp ok
vboxnet0/_a static ok
lo0/v6 static ok ::1/128

Log into the zone

The install step already booted the zone, so lets log into it. Notice how you have to be
appropriately privileged to log into a zone. This is my home system so I'm being a bit
cavalier, but in a production environment you can give granular control of who can login
to which zones. Voila! a Solaris 10 environment under a Solaris 11 kernel.
Notice the output from the uname -a and ifconfig commands, and
output from a ping to a nearby host.

$ zlogin s10u10
zlogin: You lack sufficient privilege to run this command (all privs required)
savit@home:~$ sudo zlogin s10u10
[Connected to zone 's10u10' pts/5]
Oracle Corporation

SunOS 5.10

Generic Patch

January 2005
# uname -a
SunOS s10u10 5.10 Generic_Virtual i86pc i386 i86pc
# ifconfig -a4
lo0: flags=2001000849 mtu 8232 index 1

inet netmask ff000000
vnicZBI13379: flags=1000843 mtu 1500 index 2

inet netmask ffffff00 broadcast

ether 2:8:20:5c:1a:cc
# bash
bash-3.2# ifconfig -a
lo0: flags=2001000849 mtu 8232 index 1

inet netmask ff000000
vnicZBI13379: flags=1000843 mtu 1500 index 2

inet netmask ffffff00 broadcast

ether 2:8:20:5c:1a:cc
bash-3.2# ping is alive

For fun, I configured Apache (setting its configuration file in /etc/apache2) and brought it up. Easy - took just a few minutes.

bash-3.2# svcs  apache2
disabled 12:38:46 svc:/network/http:apache2
bash-3.2# svcadm enable apache2


In just a few minutes, I built a functioning virtual Solaris 10 environment under by Solaris 11 system.
It was... easy! While I can still do it the manual way (creating and using a system archive), this
is a low-effort way to create a Solaris 10 zone on Solaris 11.

Join the discussion

Comments ( 4 )
  • guest Friday, November 25, 2011

    Nice post. Could you please try and patch that Solaris 10? I have yet not gotten my Solaris 11 env up,

  • Jeff Savit Friday, November 25, 2011

    Thanks, and that's a good idea for a followup blog entry. I'll do that next week, time permitting. regards, Jeff

  • guest Sunday, November 27, 2011

    what about licensing? Do I need to pay per virtual CPUs allocated to a VM or do I need to pay for each Solaris VM for all physical CPUs available to VMWare? What is it is a clustered vmware - do I need to pay for all physical CPUs in all vmware severs in a cluster?

  • guest Sunday, November 27, 2011

    Your question is about licensing Solaris virtual machines, not virtualized Solaris environments in zones. My understanding is that on VMware or 3rd party (non-Oracle) hardware you have to license Solaris for as many CPU cores as there are on the physical computer systems. VMware is not viewed as a "hard partitioning" technology for license purposes. There is no charge for virtual CPUs.

    This blog article is not about VMware environments: it's about Solaris zones (also called Solaris Containers, depending on context), which is a built-in virtualization technology in Solaris 10 and Solaris 11. Zones let you have very large numbers of virtualized Solaris environments (the zones) on a single Solaris instance. There is no license fee for using as many zones as you want, and there is negligible performance overhead, unlike traditional hypervisors like VMware, which can have substantial overhead in addition to their license costs. For Oracle-provided hypervisors, look into Oracle VM Server for SPARC and x86, which provides extremely efficient implementation of virtual machines.

Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.Captcha

Integrated Cloud Applications & Platform Services