Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

31–40 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#31

Post by bigodanktime »

qqumut wrote: post #9

Are Jails really that safe & secure?

Counts what you are afraid against. There's always some side channel attack that could possibly used to gain information, even on VM's this is true. Off the top of my head there could be some timing attack to gain information on which libraries others are using by reading in libraries and seeing if they are warm in the buffer cache, counts if you care about sharing the same kernel. I generally find them secure enough considering how fast they can be brought up and down.

Re: FreeBSD Jails for Fun and Profit (2020)

#32

Post by pjmlp »

drclau wrote: post #30
pjmlp wrote: post #24

Earlier quoted context omitted.

I beg to differ, given that HP-UX Virtual Vaults were quite alright and precede Jails.

(noticed your reply to my other comment too, please consider this a reply to both) I wasn't aware of HP-UX Virtual Vaults, thanks. However, I'd say FreeBSD Jails still had an advantage, due to being free and running on various hardware platforms, and more importantly on commodity hardware.

Eventually they were replaced by HP-UX Containers (SRP) a couple of years later.

Unfortunately it is hard to still find documentation, given the troubles HP-UX has gone through at HP (which kind of plays into your remark regarding FreeBSD).

Still there you go, https://support.hpe.com/hpesc/public/docDisplay?docLocale=en...

Re: FreeBSD Jails for Fun and Profit (2020)

#33

Post by laumars »

StreamBright wrote: post #28
laumars wrote: post #14

Earlier quoted context omitted.

Containerisation makes much more sense than virtualisation in a lot of areas: * lower runtime overhead * quicker deployment time * smaller image foot print Plus most of the advantages of VMs can still be applied. However it does massively depend on individual use cases. Qubes aims to be ultra secure and containers in Linux weren’t up to that task at the time (the situation has since improved massively).

- lower runtime overhead - quicker deployment time - smaller image foot print Firecracker beg to differ. I think you can do virtualisation and have all three you listed.

Sure. But for every edge case where virtualisation bridges the gap, there will be containerisation solutions that further the gap too.

Also I’m not really in the mood to engage in a dumb flame war. I’m just answering the question as to why some people favour containers for some workflows. If firecracker works for you then keep at it.

Re: FreeBSD Jails for Fun and Profit (2020)

#34

Post by drclau »

freemint wrote: post #23
drclau wrote: post #10

Earlier quoted context omitted.

Note that FreeBSD Jails were introduced in 1999, while Solaris Containers and Zones were introduces in 2004. At the time FreeBSD Jails were introduced, probably the only alternative that was wildly available was chroot, which is really far from what Jails offer. Full virtualization was too slow to be practical for most scenarios, back then. 1999 is the year when Pentium III was released.

I've seen nothing which would suggest that Solaris zones are more taxing than BSD jails. Did you imply that claim?

> Did you imply that claim?

No, I didn't. I was comparing full virtualization to Jails. However, I realize now that there may not even have been a full virtualization solution available back then anyway, at least not for consumer hardware. I'll have to dig a bit on Wikipedia.

I've never used Solaris Containers / Zones, but my understanding is that the implementation was similar to FreeBSD Jails, so I have no reason to believe the performance was different.

Re: FreeBSD Jails for Fun and Profit (2020)

#36

Post by AndrewUnmuted »

freemint wrote: post #27
AndrewUnmuted wrote: post #13

Earlier quoted context omitted.

FreeBSD's appeal for me is the easy maintenance. Everything related to config is in /etc/rc.conf; tunables in /boot/loader.conf. The ZFS implementation is rock-solid. I therefore only have to fiddle with my FreeBSD server, running 80TB ZFS storage pool, once a year or so. No other OS gives me this kind of comfort and stability.

I wonder if Solaris has bigger userbase it would also appeal to you.

Perhaps it would! But the userbase is definitely what finally got me into FreeBSD. The fact that hobbyists were contributing such excellent cli tools as `iocage` [0] and `vm-bhyve` [1] really is what got me over my fears.

[0] https://iocage.io/

[1] https://github.com/churchers/vm-bhyve

Re: FreeBSD Jails for Fun and Profit (2020)

#37

Post by hestefisk »

pjmlp wrote: post #24
drclau wrote: post #7

FreeBSD Jails were so much better than everything else out there, for a long time. I'll just copy&paste part of a comment I wrote on another HN thread some time ago, since it's relevant here: [...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1]. I had Firefox, Thunderbird, Pidgin and a few other…

I beg to differ, given that HP-UX Virtual Vaults were quite alright and precede Jails.

In the same way LPARs preceded Virtual Vaults on System z? :)

Re: FreeBSD Jails for Fun and Profit (2020)

#39

Post by pjmlp »

hestefisk wrote: post #37
pjmlp wrote: post #24

Earlier quoted context omitted.

I beg to differ, given that HP-UX Virtual Vaults were quite alright and precede Jails.

In the same way LPARs preceded Virtual Vaults on System z? :)

I guess so, but I was constraining myself to UNIXes. :)

Re: FreeBSD Jails for Fun and Profit (2020)

#40

Post by dgellow »

hestefisk wrote: post #38
dgellow wrote: post #35

Just curious, is there an equivalent (or at least similar in spirit) to FreeBSD jails in the Windows world?

Windows 10 kernel supports “Sandbox”, which might be what comes closest.

Do you mean the graphical Windows Sandbox tool? Can it also be used headless to run a service for example? That would come pretty close.
Post reply on HN