Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

81–90 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#81

Post by throwawayboise »

laumars wrote: post #76
throwawayboise wrote: post #72

Earlier quoted context omitted.

With modern hardware support for virtualization, is runtime overhead still a big deal (assuming your virtual environments are not emulating some other CPU?)

Depends on the industry. For general purpose computing it’s generally not an issue but it does matter for some specific workflows. I tend to look at it the other way though: given containerisation is so easy these days, what are the compelling reasons to run virtual machines. Neither is a wrong answer though.

VMs still provide better isolation and security, or is that no longer true?

Re: FreeBSD Jails for Fun and Profit (2020)

#82

Post by stjohnswarts »

trasz wrote: post #77
stjohnswarts wrote: post #62

Earlier quoted context omitted.

Are they superior to firejail on linux? I kind of always figured they were similar level of "sandboxing" but I never had enough interest in BSD to dig in myself.

They are completely different mechanism for doing different kind of stuff. Firejail sounds like something closer to Capsicum, but without the security model.

I was under the impression they were like jails, to sandbox a program and make it more siloed off and secure? Whatever the underlying mechanisms for obtaining that. I'll research some more I guess.

Re: FreeBSD Jails for Fun and Profit (2020)

#83

Post by tome »

trasz wrote: post #77
stjohnswarts wrote: post #62

Earlier quoted context omitted.

Are they superior to firejail on linux? I kind of always figured they were similar level of "sandboxing" but I never had enough interest in BSD to dig in myself.

They are completely different mechanism for doing different kind of stuff. Firejail sounds like something closer to Capsicum, but without the security model.

Could you elaborate on the differences? As far as I understood it firejail, or rather the Linux features that it depends upon, is far more powerful than FreeBSD jails.

Re: FreeBSD Jails for Fun and Profit (2020)

#84

Post by tptacek »

qqumut wrote: post #9

Are Jails really that safe & secure?

They're approximately as safe as modern Docker is. Upside to Docker: more security knobs (eBPF, kernel MAC, &c); upside to jails: probably easier to get right out of the box, fewer footguns. Both jails and containers (and Solaris Zones) share a fundamental security weakness, which is a kernel shared between tenants.

Re: FreeBSD Jails for Fun and Profit (2020)

#85

Post by pricci »

cpuguy83 wrote: post #58
rsync wrote: post #46

One thing I find so valuable about jails is the ability to jail a single command with no other userland than what that binary requires. Here's an example from my personal name server: /usr/sbin/jail /jails/www www 10.10.10.36 /lighttpd -f conf/lighttpd.conf ... and although this jail has a lot of content files in it, the actual UNIX userland is only what is required to run 'lighttpd': # find /jails/www/usr | wc -l 43…

Totally feasible on Linux, btw. Packaging an entire system is more about convenience than anything else. It's also pretty difficult to package just the libs one needs when you are dependent on libc and other C libs. I suspect that if one was really ok with it, some tooling could be built to copy/link in system libs into the rootfs automatically from the host.

Exodus?

Exodus – relocation of Linux binaries–and all of their deps–without containers - https://github.com/intoli/exodus

Re: FreeBSD Jails for Fun and Profit (2020)

#86

Post by redis_mlc »

StreamBright wrote: post #21
ajross wrote: post #12

Earlier quoted context omitted.

Yes, but in a sense that's the essence of why the technology got left behind. Jails were a mechanism for expert admins to play with container ideas. What the market actually wanted was Docker. And what Docker needed was Linux containers (complicated, flexible, piecewise technology) and not jails, which were higher level abstractions (but yet not high enough) with jargon and framework assumptions that didn't match Doc…

The "market" did not want Docker. Docker as a product failed. There are many reasons why FreeBSD jails count not get out for FreeBSD land, one, very important thing is the Linux community's NIH attitude.

No post body was provided.

Re: FreeBSD Jails for Fun and Profit (2020)

#87

Post by shatteredgate »

ori_b wrote: post #80
shatteredgate wrote: post #60

Earlier quoted context omitted.

And all the other ones: https://man7.org/linux/man-pages/man7/namespaces.7.html BSD jails are similar but not quite the same thing.

I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?

You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620

Re: FreeBSD Jails for Fun and Profit (2020)

#88

Post by zokula »

eddieh wrote: post #67
shrubble wrote: post #17

Earlier quoted context omitted.

The issue with zones was the lack in the early days of GNU software and the difficulty in compiling certain things. For instance, awk can act differently and if you don't know the 25 year old decisions that led to the differences, it can be very confusing. (There are different behaviors and command line switches between GNU's AWK and the version from SVR4/XPG)

Lack of GNU stuff would be a selling point.

No post body was provided.

Re: FreeBSD Jails for Fun and Profit (2020)

#89

Post by freemint »

trasz wrote: post #49
freemint wrote: post #19

Earlier quoted context omitted.

Also OS level emulation. Linux system calls can be translated to Solaris system calls allowing to run Linux specific workloads without having to emulate hardware and a full Linux kernels. Furthermore before Dtrace was ported Linux it allowed to debug Linux workloads under DTrace.

You can do both with FreeBSD in the exact same way.

I am fully aware. Parent was probably not.

Re: FreeBSD Jails for Fun and Profit (2020)

#90

Post by ajross »

ori_b wrote: post #80
shatteredgate wrote: post #60

Earlier quoted context omitted.

And all the other ones: https://man7.org/linux/man-pages/man7/namespaces.7.html BSD jails are similar but not quite the same thing.

I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?

> How are people using this flexibility to get things done in practice

Um... to loop back to the upthread point: Docker. People are using Docker, and docker is using this stuff.

Post reply on HN