Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

131–140 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#131

Post by nix23 »

fsflover wrote: post #5
freemint wrote: post #2

I never understood the appeal of BSD jails over Solaris zones which seem to be more hardened and seem to vitualize more of the OS.

Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.

> Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.

Tells me you don't know the difference between HW-Virtualisation and OS-Virtualisation.

Re: FreeBSD Jails for Fun and Profit (2020)

#133

Post by fsflover »

nix23 wrote: post #131
fsflover wrote: post #5

Earlier quoted context omitted.

Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.

> Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter. Tells me you don't know the difference between HW-Virtualisation and OS-Virtualisation.

Of course I do know it. Which is why I'm asking why you would use OS-virtualization, if HW- is possible. (Unless your hardware does not allow that of course).

Re: FreeBSD Jails for Fun and Profit (2020)

#135

Post by nix23 »

fsflover wrote: post #134
nix23 wrote: post #132

Earlier quoted context omitted.

For what? That would be the first thing to know.....

For security and workflow separation. What else is there?

On your phone, a desktop a server? For real-time applications, HPC, analytics, ML/AI? Hardware virtualization has tradeoffs...sometimes massive ones, and then you trust proprietary hardware to make it faster...again.

Re: FreeBSD Jails for Fun and Profit (2020)

#136

Post by shatteredgate »

trasz wrote: post #129
shatteredgate wrote: post #102

Earlier quoted context omitted.

>Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network…

Docker is literally just a jail. You can do whatever network topology you want using vnet. And yes, having to use root is a major issue. Looks fixable though.

Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared.

>And yes, having to use root is a major issue. Looks fixable though.

AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.

Re: FreeBSD Jails for Fun and Profit (2020)

#137

Post by trasz »

shatteredgate wrote: post #136
trasz wrote: post #129

Earlier quoted context omitted.

Docker is literally just a jail. You can do whatever network topology you want using vnet. And yes, having to use root is a major issue. Looks fixable though.

Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared. >And yes, having to use root is a major issue. Looks fixable though. AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.

Docker is practically dead, no wonder if disappeared :-)

Many things are hellishly complicated in Linux, due to politics and technical difficulties. Case in point: when I’ve started to work on NFSv4 ACLs, support in Linux was “worked on”, there was a prototype. It was 12 years ago. In FreeBSD, full supper for NFSv4 ACLs, from file systems to userspace tools, shipped decade ago. In Linux it’s still not there.

Re: FreeBSD Jails for Fun and Profit (2020)

#138

Post by philkrylov »

shatteredgate wrote: post #113
ori_b wrote: post #107

Earlier quoted context omitted.

What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.

A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how a…

> jails require you to create a chroot and network interface,

They don't: you may chroot to /, share the host's network interface, or disable networking.

Re: FreeBSD Jails for Fun and Profit (2020)

#139

Post by fsflover »

nix23 wrote: post #135
fsflover wrote: post #134

Earlier quoted context omitted.

For security and workflow separation. What else is there?

On your phone, a desktop a server? For real-time applications, HPC, analytics, ML/AI? Hardware virtualization has tradeoffs...sometimes massive ones, and then you trust proprietary hardware to make it faster...again.

Are you using open hardware for software virtualization? I'm curious which.

> On your phone, a desktop a server?

Phone doesn't support hardware virtualization of course. On my laptop I'm using Qubes OS.

Re: FreeBSD Jails for Fun and Profit (2020)

#140

Post by nix23 »

fsflover wrote: post #139
nix23 wrote: post #135

Earlier quoted context omitted.

On your phone, a desktop a server? For real-time applications, HPC, analytics, ML/AI? Hardware virtualization has tradeoffs...sometimes massive ones, and then you trust proprietary hardware to make it faster...again.

Are you using open hardware for software virtualization? I'm curious which. > On your phone, a desktop a server? Phone doesn't support hardware virtualization of course. On my laptop I'm using Qubes OS.

>Phone doesn't support hardware virtualization of course.

Every CPU "supports" hardware virtualization.

>software virtualization?

That's a "VM" like JVM, we talk about OS-Virtualisation.

Post reply on HN