FreeBSD Jails for Fun and Profit (2020) • Hacker News Board

Re: FreeBSD Jails for Fun and Profit (2020)

#41

Post by fsflover » Wed, Dec 22, 2021, 4:05 PM UTC

gaadd33 wrote: post #15

fsflover wrote: post #5

Earlier quoted context omitted.

Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.

I don't think Qubes OS existed around 2000, did it?

I was asking about what to use now.

Re: FreeBSD Jails for Fun and Profit (2020)

#42

Post by shatteredgate » Wed, Dec 22, 2021, 4:22 PM UTC

StreamBright wrote: post #21

ajross wrote: post #12

Earlier quoted context omitted.

Yes, but in a sense that's the essence of why the technology got left behind. Jails were a mechanism for expert admins to play with container ideas. What the market actually wanted was Docker. And what Docker needed was Linux containers (complicated, flexible, piecewise technology) and not jails, which were higher level abstractions (but yet not high enough) with jargon and framework assumptions that didn't match Doc…

The "market" did not want Docker. Docker as a product failed. There are many reasons why FreeBSD jails count not get out for FreeBSD land, one, very important thing is the Linux community's NIH attitude.

I don't think you can explain that as NIH. From what I have seen, Linux namespaces are a much more powerful primitive than BSD jails.

Re: FreeBSD Jails for Fun and Profit (2020)

#43

Post by mastax » Wed, Dec 22, 2021, 4:26 PM UTC

dgellow wrote: post #35

Just curious, is there an equivalent (or at least similar in spirit) to FreeBSD jails in the Windows world?

There's Windows Containers[0], which are analogous to Docker containers. They can either be run shared-kernel or in a Hyper-V container. Also Virtualization-based security[1], which is supposed to be completely transparent so it's not really a developer or deployment tool.

[0]: https://docs.microsoft.com/en-us/virtualization/windowsconta... [1]: https://docs.microsoft.com/en-us/windows-hardware/design/dev...

Re: FreeBSD Jails for Fun and Profit (2020)

#44

Post by vegai_ » Wed, Dec 22, 2021, 4:33 PM UTC

drclau wrote: post #7

FreeBSD Jails were so much better than everything else out there, for a long time. I'll just copy&paste part of a comment I wrote on another HN thread some time ago, since it's relevant here: [...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1]. I had Firefox, Thunderbird, Pidgin and a few other…

Is there a reason why FreeBSD doesn't default to running all applications in jails? Seems like this would be a pretty huge advantage compared to the typical Unix system's almost complete lack of sandboxing.

Re: FreeBSD Jails for Fun and Profit (2020)

#45

Post by antihero » Wed, Dec 22, 2021, 4:39 PM UTC

bigodanktime wrote: post #31

qqumut wrote: post #9

Are Jails really that safe & secure?

Counts what you are afraid against. There's always some side channel attack that could possibly used to gain information, even on VM's this is true. Off the top of my head there could be some timing attack to gain information on which libraries others are using by reading in libraries and seeing if they are warm in the buffer cache, counts if you care about sharing the same kernel. I generally find them secure enough…

Can a process in them exec on the rest of your system?

Re: FreeBSD Jails for Fun and Profit (2020)

#46

Post by rsync » Wed, Dec 22, 2021, 4:44 PM UTC

One thing I find so valuable about jails is the ability to jail a single command with no other userland than what that binary requires.

Here's an example from my personal name server:

  /usr/sbin/jail /jails/www www 10.10.10.36 /lighttpd -f conf/lighttpd.conf

... and although this jail has a lot of content files in it, the actual UNIX userland is only what is required to run 'lighttpd':

  # find /jails/www/usr | wc -l
  43

So it's an extremely lightweight environment with very little attack surface.

You can also share a lightweight environment with multiple commands - here are two other jail commands:

  /usr/sbin/jail /jails/dns ns1 10.10.10.30 /nsd/nsd -c /nsd/nsd.conf
  /usr/sbin/jail /jails/dns dns 10.10.10.37 /unbound/unbound -c /unbound/unbound.conf

... see how both jailings of 'nsd' and 'unbound' point to the same '/jails/dns' userland ? Once again, that userland is very, very compact:

  # find /jails/dns/|wc -l
  97

... so, 97 files total to run both name servers.

No 'make world' necessary, no building and maintaining of a full FreeBSD system - just the lightest skeleton required for both 'nsd' and 'unbound'.

Re: FreeBSD Jails for Fun and Profit (2020)

#47

Post by rsync » Wed, Dec 22, 2021, 4:49 PM UTC

drclau wrote: post #7

FreeBSD Jails were so much better than everything else out there, for a long time. I'll just copy&paste part of a comment I wrote on another HN thread some time ago, since it's relevant here: [...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1]. I had Firefox, Thunderbird, Pidgin and a few other…

"... I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks ..."

I have looked into doing this many times and it's neither simple nor straightforward.

Specifically: jailing a GUI app that you can interact with on your desktop.

I can't remember what the most promising recipe I saw for this was but it wasn't quite promising enough to compel me to built it up ... and this discussion is always (rightly) hijacked with "just use Qubes" ...

Re: FreeBSD Jails for Fun and Profit (2020)

#48

Post by trasz » Wed, Dec 22, 2021, 4:52 PM UTC

tomc1985 wrote: post #29

lordgroff wrote: post #22

Earlier quoted context omitted.

While I'm thoroughly a Linux person, I agree. I understand why Docker and the Linux container won the day, but the fact that FreeBSD is one system helps a ton with the overall intelligibility of the system inside that container. Oh, this container is Debian based, this is Centos, that one is busybox... No, every jail is just a FreeBSD system you know what you get for its bones. That's really nice.

Pretty sure you can run Debian or Busybox as a FreeBSD jail if you want

Shameless plug: https://wiki.freebsd.org/LinuxJails

Re: FreeBSD Jails for Fun and Profit (2020)

#49

Post by trasz » Wed, Dec 22, 2021, 4:55 PM UTC

freemint wrote: post #19

fsflover wrote: post #5

Earlier quoted context omitted.

Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.

Also OS level emulation. Linux system calls can be translated to Solaris system calls allowing to run Linux specific workloads without having to emulate hardware and a full Linux kernels. Furthermore before Dtrace was ported Linux it allowed to debug Linux workloads under DTrace.

You can do both with FreeBSD in the exact same way.

Re: FreeBSD Jails for Fun and Profit (2020)

#50

Post by deltarholamda » Wed, Dec 22, 2021, 4:55 PM UTC

freemint wrote: post #27

AndrewUnmuted wrote: post #13

Earlier quoted context omitted.

FreeBSD's appeal for me is the easy maintenance. Everything related to config is in /etc/rc.conf; tunables in /boot/loader.conf. The ZFS implementation is rock-solid. I therefore only have to fiddle with my FreeBSD server, running 80TB ZFS storage pool, once a year or so. No other OS gives me this kind of comfort and stability.

I wonder if Solaris has bigger userbase it would also appeal to you.

Way back when OpenSolaris was around, I put it on a server to experiment with. There was a lot to like about it, but one thing I didn't like was there was a lot of obvious cruft that has built up over the years. Things were in places that I didn't expect, but they had been there since 1904 when people wrote C with a quill pen, so SUN couldn't just move it around, because it would break MasterCard or something.

The base FreeBSD system is well thought out, and because it had the ability to, it coalesced into a very coherent system. Man pages are great, everything is where it should be.