Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

51–60 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#51

Post by Timothycquinn »

bigodanktime wrote: post #25

A great wrapper UI I have used for FreeBSD Jails is iocage ( https://iocage.readthedocs.io/en/latest/ ). Its a great project.

I was about to say the same. iocage is now the default jails wrapper on FreeNAS, which means that there is good documentation and support. The previous jails wrapper used by FreeNAS was not very well documented, but was written by some smart folks.

One thing I like about iocage is how easy it is to grant the jail access to the host ZFS datasets.

On a Jails note, I have had issues creating a jail that can do network inspection. I believe this is an issue with network restrictions of the jails subsystem itself. Eg, I could never run nmap or get mac addresses of remote hosts from within a jail.

Re: FreeBSD Jails for Fun and Profit (2020)

#52

Post by milofeynman »

luto wrote: post #3

(FreeBSD) jails are amazing. I just wish there were easier ways to use them more "cattle"-like, so I can augment or replace Docker/Podman. At the moment tooling and many of the real-world setups remind me a lot of "pet" LXC containers or even VMs in the Linux world. The tooling is slowly moving in a direction I like, though :)

I use LXC on Proxmox and I do everything with Ansible scripts. Is there something moving towards docker-like repository in LXC land? Would love to just run the latest pihole or nginx or what have you on LXC

Re: FreeBSD Jails for Fun and Profit (2020)

#54

Post by heresie-dabord »

luto wrote: post #3

(FreeBSD) jails are amazing. I just wish there were easier ways to use them more "cattle"-like, so I can augment or replace Docker/Podman. At the moment tooling and many of the real-world setups remind me a lot of "pet" LXC containers or even VMs in the Linux world. The tooling is slowly moving in a direction I like, though :)

On a Debian GNU/Linux or derivative:

apt-cache search jail

firejail - sandbox to restrict the application environment

firejail-profiles - profiles for the firejail application sandbox

firetools - Qt frontend for the Firejail application sandbox

Re: FreeBSD Jails for Fun and Profit (2020)

#55

Post by kazen44 »

vegai_ wrote: post #44
drclau wrote: post #7

FreeBSD Jails were so much better than everything else out there, for a long time. I'll just copy&paste part of a comment I wrote on another HN thread some time ago, since it's relevant here: [...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1]. I had Firefox, Thunderbird, Pidgin and a few other…

Is there a reason why FreeBSD doesn't default to running all applications in jails? Seems like this would be a pretty huge advantage compared to the typical Unix system's almost complete lack of sandboxing.

what should run in a jail? you need the base system to run jails. and that is pretty much the only thing that is installed.

Re: FreeBSD Jails for Fun and Profit (2020)

#56

Post by kazen44 »

shatteredgate wrote: post #42
StreamBright wrote: post #21

Earlier quoted context omitted.

The "market" did not want Docker. Docker as a product failed. There are many reasons why FreeBSD jails count not get out for FreeBSD land, one, very important thing is the Linux community's NIH attitude.

I don't think you can explain that as NIH. From what I have seen, Linux namespaces are a much more powerful primitive than BSD jails.

namespaces in what sense? network namespaces? because freebsd has VNET for a while now. which seems to do the same thing.

Re: FreeBSD Jails for Fun and Profit (2020)

#57

Post by VTimofeenko »

rsync wrote: post #47
drclau wrote: post #7

FreeBSD Jails were so much better than everything else out there, for a long time. I'll just copy&paste part of a comment I wrote on another HN thread some time ago, since it's relevant here: [...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1]. I had Firefox, Thunderbird, Pidgin and a few other…

"... I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks ..." I have looked into doing this many times and it's neither simple nor straightforward. Specifically: jailing a GUI app that you can interact with on your desktop. I can't remember what the most promising recipe I saw for this was but it wasn't quite promising enough to compel me to built it up ... and thi…

Firejail with spawning nested Xorg works fine for me, including text-only copypaste between "host" and "guest" and automatic file synchronization through bind-like mounts. For some firejails I also use Linux network namespaces to control traffic going through taps. My introduction to this approach was the alternative Gentoo handbook by Sakaki[1], but the principles would apply on any distro.

There's also a very interesting read on Qubes-like experience on NixOs with Wayland and XWayland[2,3].

[1]: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst...

[2]: https://roscidus.com/blog/blog/2021/03/07/qubes-lite-with-kv...

[3]: https://roscidus.com/blog/blog/2021/10/30/xwayland/

Re: FreeBSD Jails for Fun and Profit (2020)

#58

Post by cpuguy83 »

rsync wrote: post #46

One thing I find so valuable about jails is the ability to jail a single command with no other userland than what that binary requires. Here's an example from my personal name server: /usr/sbin/jail /jails/www www 10.10.10.36 /lighttpd -f conf/lighttpd.conf ... and although this jail has a lot of content files in it, the actual UNIX userland is only what is required to run 'lighttpd': # find /jails/www/usr | wc -l 43…

Totally feasible on Linux, btw.

Packaging an entire system is more about convenience than anything else. It's also pretty difficult to package just the libs one needs when you are dependent on libc and other C libs.

I suspect that if one was really ok with it, some tooling could be built to copy/link in system libs into the rootfs automatically from the host.

Re: FreeBSD Jails for Fun and Profit (2020)

#59

Post by VTimofeenko »

dgellow wrote: post #35

Just curious, is there an equivalent (or at least similar in spirit) to FreeBSD jails in the Windows world?

There used to be Virtuozzo containers for Windows and looks like they are bringing it back as a technical preview:

https://docs.virtuozzo.com/virtuozzo_hybrid_server_7_users_g...

Re: FreeBSD Jails for Fun and Profit (2020)

#60

Post by shatteredgate »

kazen44 wrote: post #56
shatteredgate wrote: post #42

Earlier quoted context omitted.

I don't think you can explain that as NIH. From what I have seen, Linux namespaces are a much more powerful primitive than BSD jails.

namespaces in what sense? network namespaces? because freebsd has VNET for a while now. which seems to do the same thing.

And all the other ones: https://man7.org/linux/man-pages/man7/namespaces.7.html

BSD jails are similar but not quite the same thing.

Post reply on HN