Dtrace support in non-global zones

by Mads
March 28, 2006 at 23:32 | categories: sun, solaris, asf

Dan Price has just announced support for dtrace in non-global zones. The mail went to dtrace discuss.

Well, I guess this is as good a time as any to announce that I've
integrated initial support for DTrace inside of Containers (a.k.a.
non-global zones) as of Friday, Mar 24, 2006.  This means that in
future Solaris Express and Community Express builds (those based on
Nevada B37 or higher), you can use a subset of DTrace functionality
inside of non-global zones.

Here's how to use this functionality:

        # zonecfg -z myzone
        zonecfg:myzone> set limitpriv=default,dtrace_proc,dtrace_user
        zonecfg:myzone> ^D

        # zoneadm -z myzone boot

        # zlogin myzone
        myzone# dtrace -l
        ...

        myzone# plockstat -Ap `pgrep startd`
        ...

Note that either or both of the dtrace_proc and dtrace_user privileges
may be granted to a zone, but dtrace_kernel may not be (zoneadm will
enforce this).  The lack of dtrace_kernel means that not every DTrace
script will work, since kernel state is not available to DTrace inside
of a zone; but we think this represents a good start.

Additional virtualization work has been done to ensure that data from
other zones is not visible inside the zone, and to ensure that the
interactions with other relevant privileges (proc_owner and proc_zone)
behave as expected.

        -dp

The whole thread is here.

I'm really looking forward to getting this in a release so that we can bring it onto the ASF zones server.