Ask HN: What's wrong with FreeBSD Jails?

#1

Post by akandiah » Tue, Aug 22, 2017, 9:00 AM UTC

I see a lot of people going with Docker for shipping products. Why don't more people choose Jails? Is there anything wrong with it? From what I can gather it's a far more mature implementation of containers.

Re: Ask HN: What's wrong with FreeBSD Jails?

#2

Post by brudgers » Tue, Aug 22, 2017, 1:05 PM UTC

Docker runs on Linux. Docker runs on Mac. Docker runs on Windows. Not running on those platforms is an engineering tradeoff Jails makes. There's nothing wrong with that tradeoff but it does have hard implications.

Re: Ask HN: What's wrong with FreeBSD Jails?

#3

Post by debdrup » Tue, Aug 22, 2017, 1:29 PM UTC

brudgers wrote: post #2

Docker runs on Linux. Docker runs on Mac. Docker runs on Windows. Not running on those platforms is an engineering tradeoff Jails makes. There's nothing wrong with that tradeoff but it does have hard implications.

Docker runs on FreeBSD too, and it'll hopefully run even better in the future once the results from https://wiki.freebsd.org/DockerHackDay2017 come in.

FreeBSD jails can't just be easily ported to any platform, as they're not designed for portability - kernel-features being portable wasn't really a thing back in the late 1990s when jails were developed. They're designed to contain software (in fact, the title of the original paper is quite demonstrably "confining the omnipotent root"), which is why they're the first actual type of container (chroots original purpose isn't known by anyone but Bill Joy and while he isn't saying anything much on the subject, its first documented use that I know of was building BSD in a clean enviroment).

Re: Ask HN: What's wrong with FreeBSD Jails?

#4

Post by debdrup » Tue, Aug 22, 2017, 1:34 PM UTC

My guess would be that it's because jails are exclusive to FreeBSD, and not that many people (compared to Linux, that is) run FreeBSD. Jails were also devised as a tool for the sysadmins toolbox, whereas docker is a tool for developers toolbox - and each has its own strengths and weaknesses.

Finally, jails do lack a bit of the functionality that lets docker do some things - but that isn't something that can't exist, an in fact there are certain signs that such instrumentation might be in the process of being written: https://twitter.com/FiLiS/status/894651614002393088.