Hacker News Reader

Comment by rubatuga | Hacker News Reader

Anybody know what the benefits of a BSD jail might be over a VM?

lighter weight than a VM. It uses the same kernel as the rest of the system, but sandboxes the userspace to limit what impact it can have on the rest of the system. They're not quite equivalent to a container on Linux but they're very similar in functionality.

VNET jails, as the author is using, also have a completely stand-alone network stack from the host-OS!

Aren't cgroups / containers a very close equivalent? In either case, it's namespacing, of a tree of userspace processes to make them invisible from the rest of the userspace.

FreeBSD jails are additional jailed (chrooted) userlands using kernel of the host. They can be as fat as complete FreeBSD userland, or as thin as just a few binaries and libraries necessary to run particular service.

https://www.freebsd.org/doc/handbook/jails.html

They're much more than just a chroot (that's a concept of limiting your process filesystem access), can have their own TCP stack, their own firewall, their resource usage limits and so on. They are much, much closer to Linux containers, than to chroot actually.

You are right about them being much more than chroot, the ability to limit device access and set other resource limits has been possible since a long time ago. VNET jails, introduced fairly recently (12.0-RELEASE with GENERIC kernel, 11.0-RELEASE with custom compiled kernel if I'm not mistaken), can have their own TCP stack and firewall.

I am not familiar with Linux containers, but I read that FreeBSD jails are much, much different from them. As for chroot, it still plays crucial role in FreeBSD jail implementation.

Apples and oranges. Jails to not support any other operating system than the host.

> Jails to not support any other operating system than the host.

This oversimplifies. The kernel is the same in the jail and the host. But FreeBSD has a Linux syscall emulation layer, and you can definitely install a Linux userspace in a jail and run essentially Linux-but-the-kernel in the jail.

Still learning, but the diff would be similar between VMs and Containers on Linux.

Reply on news.ycombinator.com