Non-global zones provide the following features:
Once a process has been placed in a zone other than the globalzone, neither the process nor any of its subsequent children can change zones.
Network services can be run in a zone. By running network services ina zone, you limit the damage possible in the event of a security violation.An intruder who successfully exploits a security flaw in software runningwithin a zone is confined to the restricted set of actions possible withinthat zone. The privileges available within a zone are a subset of those availablein the system as a whole.
Zones allow the deployment of multiple applications on thesame machine, even if those applications operate in different trust domains,require exclusive access to a global resource, or present difficulties withglobal configurations. The applications are also prevented from monitoringor intercepting each other's network traffic, file system data, or processactivity.
Zones are configured as exclusive-IP type by default. Thezones are isolated from the global zone and from each other at the IP layer.This isolation is useful for both operational and security reasons. Zonescan be used to consolidate applications that must communicate on differentsubnets using their own LANs or VLANs. Each zone can also define its own IPlayer security rules.
Zones provide a virtualized environment that can hide detailssuch as physical devices and the system's primary IP address and host namefrom applications. The same application environment can be maintained on differentphysical machines. The virtualized environment allows separate administrationof each zone. Actions taken by a zone administrator in a non-global zone donot affect the rest of the system.
A zone can provide isolation at almost any level of granularity.SeeNon-Global Zone Characteristics formore information.
Zones do not change the environment in which applicationsexecute except when necessary to achieve the goals of security and isolation.Zones do not present a new API or ABI to which applications must be ported.Instead, zones provide the standard Oracle Solaris interfaces and applicationenvironment, with some restrictions. The restrictions primarily affect applicationsthat attempt to perform privileged operations.
Applications in the global zone run without modification, whether or not additional zones areconfigured.