Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

141–150 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#141

Post by nix23 »

fsflover wrote: post #133
nix23 wrote: post #131

Earlier quoted context omitted.

> Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter. Tells me you don't know the difference between HW-Virtualisation and OS-Virtualisation.

Of course I do know it. Which is why I'm asking why you would use OS-virtualization, if HW- is possible. (Unless your hardware does not allow that of course).

Since you know the difference you know the pro and contra.

Re: FreeBSD Jails for Fun and Profit (2020)

#142

Post by shatteredgate »

trasz wrote: post #137
shatteredgate wrote: post #136

Earlier quoted context omitted.

Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared. >And yes, having to use root is a major issue. Looks fixable though. AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.

Docker is practically dead, no wonder if disappeared :-) Many things are hellishly complicated in Linux, due to politics and technical difficulties. Case in point: when I’ve started to work on NFSv4 ACLs, support in Linux was “worked on”, there was a prototype. It was 12 years ago. In FreeBSD, full supper for NFSv4 ACLs, from file systems to userspace tools, shipped decade ago. In Linux it’s still not there.

Docker wasn't dead 5 or 6 years ago when I heard about this. In my experience some things are easier to implement in Linux and some are easier to implement in BSD. I don't particularly care for BSD's internal politics either, such as the licensing issues mentioned elsewhere here.

Re: FreeBSD Jails for Fun and Profit (2020)

#143

Post by kazen44 »

philkrylov wrote: post #138
shatteredgate wrote: post #113

Earlier quoted context omitted.

A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how a…

> jails require you to create a chroot and network interface, They don't: you may chroot to /, share the host's network interface, or disable networking.

also, with epairs you can do some really flexible networking stuff on freebsd between jails/jails and the host system and even jails and ipsec tunnels.

Re: FreeBSD Jails for Fun and Profit (2020)

#144

Post by trasz »

shatteredgate wrote: post #142
trasz wrote: post #137

Earlier quoted context omitted.

Docker is practically dead, no wonder if disappeared :-) Many things are hellishly complicated in Linux, due to politics and technical difficulties. Case in point: when I’ve started to work on NFSv4 ACLs, support in Linux was “worked on”, there was a prototype. It was 12 years ago. In FreeBSD, full supper for NFSv4 ACLs, from file systems to userspace tools, shipped decade ago. In Linux it’s still not there.

Docker wasn't dead 5 or 6 years ago when I heard about this. In my experience some things are easier to implement in Linux and some are easier to implement in BSD. I don't particularly care for BSD's internal politics either, such as the licensing issues mentioned elsewhere here.

It might be because it would require reimplementing all the system-specific Docker parts from scratch. Not sure though.

BSD doesn't really have any licensing issues, thanks to BSD license, but politics is directly related to project size. In FreeBSD it's pretty much unnoticeable, but in Linux it can be a huge deal.

Re: FreeBSD Jails for Fun and Profit (2020)

#145

Post by trasz »

heavyset_go wrote: post #118
rsync wrote: post #46

One thing I find so valuable about jails is the ability to jail a single command with no other userland than what that binary requires. Here's an example from my personal name server: /usr/sbin/jail /jails/www www 10.10.10.36 /lighttpd -f conf/lighttpd.conf ... and although this jail has a lot of content files in it, the actual UNIX userland is only what is required to run 'lighttpd': # find /jails/www/usr | wc -l 43…

Can you use jails with, say, and a bindfs / overlayfs / snapshot type of file-system, to run an executable in a jail that's a restricted and read-only view of your currently running system? I did some reading and it looks like FreeBSD's unionfs or nullfs would handle the file-system part.

Yes. If it's literally read-only then it's safe and easy (just use read-only nullfs); if it's to be writable, but read-only below (like overlayfs), you'll have to use unionfs which is still a bit... temperamental.

Re: FreeBSD Jails for Fun and Profit (2020)

#146

Post by VTimofeenko »

tome wrote: post #128
VTimofeenko wrote: post #57

Earlier quoted context omitted.

Firejail with spawning nested Xorg works fine for me, including text-only copypaste between "host" and "guest" and automatic file synchronization through bind-like mounts. For some firejails I also use Linux network namespaces to control traffic going through taps. My introduction to this approach was the alternative Gentoo handbook by Sakaki[1], but the principles would apply on any distro. There's also a very inter…

What's nested Xorg? Do you mean you run each app in a separate VNC or RDP server?

An example would be Xephyr[1]. Archwiki[2] has a decent summary.

In my case, I have the standard xorg session started by my login manager. Then I start Xephyr with a separate DISPLAY, that shows up as just a window in the parent environment. It does look kinda like RDP or VNC.

[1]: https://linux.die.net/man/1/xephyr [2]: https://wiki.archlinux.org/title/Xephyr

Re: FreeBSD Jails for Fun and Profit (2020)

#147

Post by trasz »

philkrylov wrote: post #138
shatteredgate wrote: post #113

Earlier quoted context omitted.

A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how a…

> jails require you to create a chroot and network interface, They don't: you may chroot to /, share the host's network interface, or disable networking.

It's literally a single command:

  trasz@v3:~ % doas jail / foo 127.0.0.1 /bin/sh
  # ps aux
  USER   PID %CPU %MEM   VSZ  RSS TT  STAT STARTED    TIME COMMAND
  root 37975  0,0  0,0 13500 3056  3  SJ   09:11   0:00,01 /bin/sh
  root 37976  0,0  0,0 13624 2776  3  R+J  09:11   0:00,00 ps aux

Re: FreeBSD Jails for Fun and Profit (2020)

#148

Post by tome »

VTimofeenko wrote: post #146
tome wrote: post #128

Earlier quoted context omitted.

What's nested Xorg? Do you mean you run each app in a separate VNC or RDP server?

An example would be Xephyr[1]. Archwiki[2] has a decent summary. In my case, I have the standard xorg session started by my login manager. Then I start Xephyr with a separate DISPLAY, that shows up as just a window in the parent environment. It does look kinda like RDP or VNC. [1]: https://linux.die.net/man/1/xephyr [2]: https://wiki.archlinux.org/title/Xephyr

That's very cool, thanks!

Re: FreeBSD Jails for Fun and Profit (2020)

#149

Post by shatteredgate »

trasz wrote: post #144
shatteredgate wrote: post #142

Earlier quoted context omitted.

Docker wasn't dead 5 or 6 years ago when I heard about this. In my experience some things are easier to implement in Linux and some are easier to implement in BSD. I don't particularly care for BSD's internal politics either, such as the licensing issues mentioned elsewhere here.

It might be because it would require reimplementing all the system-specific Docker parts from scratch. Not sure though. BSD doesn't really have any licensing issues, thanks to BSD license, but politics is directly related to project size. In FreeBSD it's pretty much unnoticeable, but in Linux it can be a huge deal.

That has not been my experience. The issues are with licenses other than BSD but that's the same in Linux; Linux can also use BSD code, a lot of Linux code is actually dual licensed as BSD already.

Re: FreeBSD Jails for Fun and Profit (2020)

#150

Post by eddieh »

trasz wrote: post #120
eddieh wrote: post #79

Earlier quoted context omitted.

It doesn't have to be procfs, but it would be nice to have a /proc like interface.

How it would be better than existing sysctl(3)-based one?

Okay, I'll admit I just want it to be more like Plan 9. sysctl, ioctl, fcntl, sockets, could all have a file based interface. Maybe it isn't any better.
Post reply on HN