Proxy settings needed to update IPS packages for Solaris 11 zones

Under Solaris 11 we use the new IPS (Image Packaging System) to maintain the software on the servers. IPS, written in python and uses libcurl, which for none-zoned systems setting the http_proxy is sufficient to allow the system to communicate with the repository

# export http_proxy="http://proxy-server:3128"

However, with Solaris zones this is not sufficient because of how zones are updated.

On a system without zones you run ‘pkg install’ or ‘pkg update’ and it directly communicates with the publisher, so an environment variable to set the proxy will work in this case.

For Solaris zones the local zones communicate with the system repository service, they do not communicate with the publisher directly. As a service it does not get its environment from the shell you issue the pkg command from, hence it will not know about the proxy.

The resolution is to set the http_proxy property for the service.

You do this by, for example:

# svccfg -s svc:/application/pkg/system-repository:default setprop config/http_proxy=astring: "http://proxy-ip:3128"
# svcadm refresh svc:/application/pkg/system-repository:default

You can check the current proxy settings by

# svcprop svc:/application/pkg/system-repository:default | grep _proxy
config/http_proxy astring ""
config/https_proxy astring ""

You can read the official Oracle stance on this @ http://docs.oracle.com/cd/E23824_01/html/821-1460/glqjr.html