Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

101–110 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#101

Post by shatteredgate »

ori_b wrote: post #93
shatteredgate wrote: post #87

Earlier quoted context omitted.

You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620

Yes, I am aware that it's got more moving parts. What are you using this flexibility for?

I'm using them for several things but the most straightforward one is probably that namespacing can be gradually added to services, you most likely see benefits from this already if you use systemd. That's one way that namespaces can be used in a different way from the docker model.

Re: FreeBSD Jails for Fun and Profit (2020)

#102

Post by shatteredgate »

trasz wrote: post #99
shatteredgate wrote: post #87

Earlier quoted context omitted.

You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620

This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.

>Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide.

Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network topology features seem to just not be possible or straightforward. But I could be wrong, I have not looked into the technical details of this in years, somebody told me it might have been working a while ago but I never heard anything else about it since.

Needing to be root is a major deficiency though and I can't take jails seriously with that, one of the main focuses on Linux containers in the past several years has been to make unprivileged namespaces a good option.

Re: FreeBSD Jails for Fun and Profit (2020)

#103

Post by shatteredgate »

ori_b wrote: post #94
ajross wrote: post #90

Earlier quoted context omitted.

> How are people using this flexibility to get things done in practice Um... to loop back to the upthread point: Docker. People are using Docker, and docker is using this stuff.

And how is it mixing and matching these APIs? Given that there's an OCI-compatible runner for jails (runj, compatible with runc -- which is what docker uses to start containers), it seems to me that Docker isn't in actually using the flexibility afforded by the APIs here, but is just using a relatively fixed set of options. If I'm wrong: what is it using, and what problems is this flexibility solving?

I haven't tested runj but just from looking at it, it seems it is not fully compatible with everything that runc does because the OCI itself specifies a lot of Linux-specific functionality.

Re: FreeBSD Jails for Fun and Profit (2020)

#104

Post by shatteredgate »

StreamBright wrote: post #96
shatteredgate wrote: post #42

Earlier quoted context omitted.

I don't think you can explain that as NIH. From what I have seen, Linux namespaces are a much more powerful primitive than BSD jails.

Well, looking at the following things sort of gives it away: - brtfs vs zfs - cgroups vs jails - SystemTap vs dtrace - Systemd vs smf I get it, many of these were due to licensing issues. So they said[1]. Anyways, there are still some things to implement for linux. pf is my favourite (software) firewall. It would be great to see it ported to Linux. 1. https://opensource.stackexchange.com/questions/2094/are-cddl...

In my experience, both Linux developers and BSD developers don't seem to care too much about porting things to the other's operating system. If you want to do things the Linux way you can use Linux, and if you want to do things the BSD way you can use BSD. That's seen as easier than trying to glue two incompatible things together.

Re: FreeBSD Jails for Fun and Profit (2020)

#105

Post by int_19h »

shatteredgate wrote: post #104
StreamBright wrote: post #96

Earlier quoted context omitted.

Well, looking at the following things sort of gives it away: - brtfs vs zfs - cgroups vs jails - SystemTap vs dtrace - Systemd vs smf I get it, many of these were due to licensing issues. So they said[1]. Anyways, there are still some things to implement for linux. pf is my favourite (software) firewall. It would be great to see it ported to Linux. 1. https://opensource.stackexchange.com/questions/2094/are-cddl...

In my experience, both Linux developers and BSD developers don't seem to care too much about porting things to the other's operating system. If you want to do things the Linux way you can use Linux, and if you want to do things the BSD way you can use BSD. That's seen as easier than trying to glue two incompatible things together.

BSD developers can't port things from Linux in a straightforward manner due to license issues. But that doesn't apply the other way around.

Re: FreeBSD Jails for Fun and Profit (2020)

#106

Post by int_19h »

drclau wrote: post #34
freemint wrote: post #23

Earlier quoted context omitted.

I've seen nothing which would suggest that Solaris zones are more taxing than BSD jails. Did you imply that claim?

> Did you imply that claim? No, I didn't. I was comparing full virtualization to Jails. However, I realize now that there may not even have been a full virtualization solution available back then anyway, at least not for consumer hardware. I'll have to dig a bit on Wikipedia. I've never used Solaris Containers / Zones, but my understanding is that the implementation was similar to FreeBSD Jails, so I have no reason t…

Virtual PC and VMware did full virtualization on commodity hardware at the time (Macs and Windows PCs, respectively). But it was slow enough that it was mostly used for development and testing back then, and certainly not viable for any kind of routine sandboxing.

Re: FreeBSD Jails for Fun and Profit (2020)

#107

Post by ori_b »

shatteredgate wrote: post #101
ori_b wrote: post #93

Earlier quoted context omitted.

Yes, I am aware that it's got more moving parts. What are you using this flexibility for?

I'm using them for several things but the most straightforward one is probably that namespacing can be gradually added to services, you most likely see benefits from this already if you use systemd. That's one way that namespaces can be used in a different way from the docker model.

What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.

Re: FreeBSD Jails for Fun and Profit (2020)

#108

Post by int_19h »

deltarholamda wrote: post #50
freemint wrote: post #27

Earlier quoted context omitted.

I wonder if Solaris has bigger userbase it would also appeal to you.

Way back when OpenSolaris was around, I put it on a server to experiment with. There was a lot to like about it, but one thing I didn't like was there was a lot of obvious cruft that has built up over the years. Things were in places that I didn't expect, but they had been there since 1904 when people wrote C with a quill pen, so SUN couldn't just move it around, because it would break MasterCard or something. The ba…

To be fair, "a lot of obvious cruft that has built up over the years" also describes old-school Unix as a whole, FreeBSD included. It's just that we got used to many of those things.

Re: FreeBSD Jails for Fun and Profit (2020)

#109

Post by [deleted] »

shatteredgate wrote: post #102
trasz wrote: post #99

Earlier quoted context omitted.

This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.

>Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network…

[deleted]

Re: FreeBSD Jails for Fun and Profit (2020)

#110

Post by ori_b »

shatteredgate wrote: post #102
trasz wrote: post #99

Earlier quoted context omitted.

This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.

>Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network…

> Needing to be root is a major deficiency though

Note: Linux also needs root for its namespaces. Or at least CAP_SYS_SYSADMIN, which grants enough that it's pretty much as good as root. See setns(2) and clone(2) for details. This is one of the complaints the plan 9 people have always had with Linux namespaces.

Post reply on HN