Creating Comfy FreeBSD Jails Using Standard Tools
kettunen.io
kettunen.io
https://blog.uidrafter.com/engineering/freebsd-jails-network...
Why VNET? "VNET jails give each jail its own isolated copy of the network stack" https://klarasystems.com/articles/virtualize-your-network-on...
I like the simplicity and how straightforward it is to add new servers to our home. I have long history with docker, but kind of prefer the way of being able to ssh into the jail and manage it like a normal server distro. Docker again is much nicer in the daily development flow, where I want nine different databases in a clean state every morning.
The ports Makefile framework is incredibly sophisticated, so one can find lots of examples and be quickly able create and test ports very easily, especially for packages written in C, C++, Go, Java, Perl, Python, Ruby, etc. Poudriere, which is the definitive bulk package builder used by FreeBSD pkg itself, is especially useful here. Ports that a have a billion vendored libraries are a pain. Ports are not allowed to download from the internet at build time, so all the vendor dependencies need to be known beforehand and be marshaled to download at the "fetch" phase accordingly. But eventually it all boils down to a very terse and declarative Makefile. What used to be a bigger pain, was the way to update ports in the ports tree, which used to require someone with access to the ports tree taking your new port and updating it. But recent news indicate that FreeBSD is moving to git and towards a model where port owners can each update their own directly, which will be huge. My personal opinion is that this will lower the ports maintenance bar significantly.
Also, for administrators, switching /etc/pkg/FreeBSD.conf from "quarterly" to "latest" pkg train of your version number (e.g. FreeBSD 12.x) will get you the latest versions of binary packages, as soon as their respective port is released into the ports tree. Quarterly is also pretty good, but you get only security updates and package versions tend to stay stable and change every quarter. I've administered systems switched to "latest" and seldom had any serious problems.
I have now only pihole running on LXD and it's ok.
My unbound dns server, for instance, has something like 24 total files in it. The reason it has so many is because I run two different jails from it - my unbound jail and my nsd jail share the same directory/mountpoint.
Which is to say, I run two different jail commands, that start two different jails with different IPs and startup commands, but they both point to the same directory/mountpoint.
Updates consist of replacing a few binary executables.
Not everything will fit into that model, but when it does, it is fantastic.
jail -c path=/ ip4.addr=disable ip6=inherit command=/bin/csh
So you can use jails to sandbox applications. You can also mount all paths are read-only and only the paths required for the application as read/write. jails can be very handy for all kinds of operations around that, there is no requirement that you provide the jail with a copy of the user land again, although that is the easiest way to run jails.
I have no doubt that Linux containers are just as secure as FreeBSD Jails, but if the implementation and tooling is complex, there is a much higher risk of something being configured wrong.
And then there's the giant gorilla in the room, Docker, which probably has the best tooling of them all, and initially used Linux containers, but has since moved on to their own container implementation (runC, https://www.docker.com/blog/runc/).
RunC isn't "their own implementation" but rather an OCI (Open Containers Initiative) standard that world seems to be adopting and I wish FreeBSD Jails would be a part of it.