container_system.5 (2011 09)

CONTAINER_SYSTEM(5) CONTAINER_SYSTEM(5)
NAME
container_system - Describes the HP-UX system containers
DESCRIPTION
System containers provide virtualization and private namespace capabilities that give users the look and
feel of a private operating system instance. They provide process view isolation,
IPC isolation, and a dedi-
cated
IP address interface. All system containers have a private set of configuration files and service dae-
mons. System containers provide a private namespace for file system view, hostname, nodename, domain-
name, System V IPC,and Loopback IP address. They require system software installation synchronization
with the system.
Process View
Only processes within a system container are visible in a container, processes in one container cannot
view or signal processes outside of the container.
Host, Node, and Domain Names
Each system container has its own hostname, nodename, and domain name. These names are initially
defined when the container is created, but they can be modified from within the container. Processes
within a system container will see the host, node, and domain name of the container.
User and Groups
System containers are provisioned with a separate set of configuration files and service daemons used to
manage user and groups, login authentication, and name service resolution. Administration of these
activities must be performed inside of each system container.
File Systems
A system container may be created with either a private or a shared file system. If a system container is
created with a private file system, it will be populated with its own read/write copy of the system direc-
tories, excluding the /stand directory. The /stand directory will be a read-only loopback mounted file
system mounted from the global /stand directory. If a system container is created with a shared file sys-
tem, it will be populated with its own read/write copies of the system directories, excluding the /stand,
/usr, and /sbin directories; these directories will be read-only loopback mounted file systems mounted
from the corresponding global view directories.
When a container is configured, srp(1M) creates a new container home directory (/var/hpsrp/<container
name>). All processes running in a system container are chrooted to the container home directory, thus
providing a unique file system view for the container.
NFS and AutoFS Mounted File Systems
NFS server functionality is supported only in the global view (using the primary system
IP address) and
not in the system containers. You must configure directory shares as an absolute path from the global
system root directory, and the directories must be mounted when the shares are exported in the global
view.
NFS and Autofs mount is supported inside a system container as in a standard system. The NFS mount
must be done inside the container, NFS mount from the global view on behalf of a container (such as
specifying the mount point as a path under a container home directory /var/hpsrp/<container_name>)is
not supported. Access to container
NFS mounted directories are denied from the global view.
The shares exported from the global view can be mounted inside a system container by using the global
view hostname as the
NFS server inside a system container.
Mounted File Systems
File Systems such as NFS, LOFS, and VxFS may be mounted in a system container when the container is
started if there is an appropriate entry in the container’s /etc/fstab file as described in fstab(4).
Network Isolation
Each system container is provided with its own IP address and private network port space. Processes in a
system container can only bind to addresses local to the container. Packets destined to a container IP
address are delivered to the appropriate network endpoints in the container. Packets originated from a
container will have the source address set to the container IP address.
HP-UX 11i Version 3: September 2011 − 1 − Hewlett-Packard Company 1