Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CBSD – FreeBSD Jail Management Tools

bsdstore.ru

Post reply on HN
Print view View original

21–30 of 42 posts

Re: CBSD – FreeBSD Jail Management Tools

#21

Post by nzp »

dotemacs wrote: post #19
nzp wrote: post #16

Earlier quoted context omitted.

> What kind of things to people use FreeBSD for? HN for start. And then there's (off the top of my head) Netflix, NetApp, Juniper, Sony, countless ISPs, DuckDuckGo...

It seems that HN have switched to a different OS, but used be on FreeBSD: (scroll to "Hosting History") http://toolbar.netcraft.com/site_report?url=https%3A%2F%2Fne...

Linux in there is probably just because of CloudFlare. I had no idea what was HN running on until that outage a week or so ago with the switching of servers etc. A Tell HN[1] about the incident says they were using UFS and now switched to ZFS, and that can only mean FreeBSD.

[1] https://news.ycombinator.com/item?id=7069013

Re: CBSD – FreeBSD Jail Management Tools

#23

Post by ithkuil »

nzp wrote: post #8

This project seems great, but I feel there's something wrong with the submitted article title, it sounds weird (plus, there's no mention of Docker on the linked page). Sure, you can draw parallels between Docker and what FreeBSD jails and tools built on top do, but it would be fairer to say Docker is a Linux based alternative to jails, and not as powerful (as far as I understand Linux kernel infrastructure that Docke…

Why do you say that lxc (and cgroups) are less powerful than FreeBSD jails?

From what I read in https://wiki.freebsd.org/Jails, jails don't yet have support for:

  * separate PID space
  * IO isolation
cgroups provide extremely fine grained isolation, including among other things:

  * per-container OOM handler (userspace)
  * per-container swap
  * per-container disk I/O scheduling
  * per-container memory reclaim
  * per-container dirty page (write throttling) limit.
These are very important features if you want to increase your utilization by mixing workload on shared machines.

Re: CBSD – FreeBSD Jail Management Tools

#25

Post by jlgaddis »

FWIW, the PC-BSD project (think "FreeBSD fine-tuned for the Desktop") has written various tools to help managing such things as FreeBSD jails easier -- see, for example, warden [0]).

If you're looking to try it out but don't need/want the desktop/GUI, there's also TrueOS. It's basically FreeBSD plus all the cool management tools they've written but minus the desktop/GUI.

[0]: http://wiki.pcbsd.org/index.php/Warden%C2%AE/10.0

Re: CBSD – FreeBSD Jail Management Tools

#26

Post by rsync »

tinco wrote: post #6

dallagi: your comments are marked as dead. Judging from your comments there's no real reason for it, so I think a bot did it because you commented on a troll submission. for the rest of HN: Isn't one of Dockers killer features the layered file system? Using rsync for making new jails seems like it's going to be real slow for reprovisioning. What kind of things to people use FreeBSD for? I wonder if they're really roo…

rsync.net is run entirely on FreeBSD.

Further, it may interest you to know that we (JohnCompanies) used FreeBSD and jail to provide the first VPS services[1], back in fall of 2001. The VPS as we know it (which appears to be dying in the world of EC2-style instances) came into existence as a direct result of jail.

[1] Yes, Verio did have that bizarro VPS-like service that cost an arm and a leg a year or so earlier, but the VPS as you think of it was first provided (AFAIK) by JohnCompanies in 2001.

Re: CBSD – FreeBSD Jail Management Tools

#27

Post by jlgaddis »

nzp wrote: post #20
enduser wrote: post #18

Earlier quoted context omitted.

PKGNG is the default (integrated) package managers in 10.0-RELEASE.

It's the default alright, but that has nothing to do with it being in the base (yes, it's an exception to the rule). You can look it up on the freebsd-ports@, there were somewhat heated discussions concerning this and some other issues. Unless I've missed something, this decision hasn't changed.

pkg can also bootstrap itself. I don't have a fresh FreeBSD install w/o pkg already installed but upon first use it basically goes like this:

  $ pkg foo
  pkg is not installed. Install it? (y/n) y
  ...
  pkg is now installed

Re: CBSD – FreeBSD Jail Management Tools

#29

Post by jlgaddis »

tinco wrote: post #6

dallagi: your comments are marked as dead. Judging from your comments there's no real reason for it, so I think a bot did it because you commented on a troll submission. for the rest of HN: Isn't one of Dockers killer features the layered file system? Using rsync for making new jails seems like it's going to be real slow for reprovisioning. What kind of things to people use FreeBSD for? I wonder if they're really roo…

> What kind of things to people use FreeBSD for?

ISPs have been big users of FreeBSD. While HN is a lot of startups going on about agile, continuous integration, Jenkins, etc., those of us in enterprise and ISP environments like stability and little change.

When deploying a new mail system for 100k users, for example, I want to set it up, get it working perfectly, and then not have to touch it (exception: security updates, of course) for the next few years.

FreeBSD is rock solid and lets you do just that. FreeBSD 8.0-RELEASE was announced in November 2009, if memory serves, and I still have DNS servers running 8.x that I rarely have to touch (and won't have to until June 30, 2015). It Just Works(TM).

Re: CBSD – FreeBSD Jail Management Tools

#30

Post by shykes »

nzp wrote: post #12
tachion wrote: post #9

Earlier quoted context omitted.

The thing is that it is Docker that 'seems' to be leading the container movement right now, being a mainstream tool, even though Jails were available earlier and as of now seem to be more powerful than LXC. Also, Jails are not only security feature, but can be as good deployment feature, as Docker, if not better - it all depends what you want to do with them, and you can do a lot. I called CBSD an alternative to Dock…

Well, I had a hunch it was for this reason. I usually get grumpy when an arguably superior solution is presented as an 'alternative' to something that's just more popular because it's easier that way for people to grok what it's all about. But on the other hand, I've never been good at marketing, so who am I to complain. :)

Docker and Jails are not directly comparable, the same way Docker and raw lxc are not directly comparable. Docker operates at a higher level of abstraction, and uses lxc as a low-level sandboxing tool. It could (and soon will) offer a choice of multiple sandboxing backends beyond lxc, for example simple chroot (for older linux kernels), openvz, libvirt, etc.

There are also people experimenting with using Jails and Solaris zones as a backend to docker.

From what I'm reading, this project cbsd sounds like a more direct competitor of docker + a future jails backend.

Post reply on HN