# SOME DESCRIPTIVE TITLE # Copyright (C) YEAR The FreeBSD Project # This file is distributed under the same license as the FreeBSD Documentation package. # FIRST AUTHOR , YEAR. # #, fuzzy msgid "" msgstr "" "Project-Id-Version: FreeBSD Documentation VERSION\n" "POT-Creation-Date: 2026-08-16 15:11-0300\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. type: Yaml Front Matter Hash Value: description #: documentation/content/en/books/handbook/jails/_index.adoc:1 #, no-wrap msgid "Jails improve on the concept of the traditional chroot environment in several ways" msgstr "" #. type: Yaml Front Matter Hash Value: part #: documentation/content/en/books/handbook/jails/_index.adoc:1 #, no-wrap msgid "Part III. System Administration" msgstr "" #. type: Yaml Front Matter Hash Value: title #: documentation/content/en/books/handbook/jails/_index.adoc:1 #, no-wrap msgid "Chapter 17. Jails and Containers" msgstr "" #. type: Title = #: documentation/content/en/books/handbook/jails/_index.adoc:15 #, no-wrap msgid "Jails and Containers" msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:52 #, no-wrap msgid "Synopsis" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:58 msgid "" "Since system administration is a difficult task, many tools have been " "developed to make life easier for the administrator. These tools often " "enhance the way systems are installed, configured, and maintained. One of " "the tools which can be used to enhance the security of a FreeBSD system is " "_jails_. Jails have been available since FreeBSD 4.X and continue to be " "enhanced in their usefulness, performance, reliability, and security." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:63 msgid "" "Jails build upon the man:chroot[2] concept, which is used to change the root " "directory of a set of processes. This creates a safe environment, separate " "from the rest of the system. Processes created in the chrooted environment " "can not access files or resources outside of it. For that reason, " "compromising a service running in a chrooted environment should not allow " "the attacker to compromise the entire system." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:67 msgid "" "However, a chroot has several limitations. It is suited to easy tasks which " "do not require much flexibility or complex, advanced features. Over time, " "many ways have been found to escape from a chrooted environment, making it a " "less than ideal solution for securing services." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:69 msgid "" "Jails improve on the concept of the traditional chroot environment in " "several ways." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:75 msgid "" "In a traditional chroot environment, processes are only limited in the part " "of the file system they can access. The rest of the system resources, " "system users, running processes, and the networking subsystem are shared by " "the chrooted processes and the processes of the host system. Jails expand " "this model by virtualizing access to the file system, the set of users, and " "the networking subsystem. More fine-grained controls are available for " "tuning the access of a jailed environment. Jails can be considered as a " "type of operating system-level virtualization." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:77 msgid "This chapter covers:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:79 msgid "What a jail is and what purpose it may serve in FreeBSD installations." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:80 msgid "The different types of jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:81 msgid "The different ways to configure the network for a jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:82 msgid "The jail configuration file." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:83 msgid "How to create the different types of jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:84 msgid "How to configure network address translation for jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:85 msgid "How to start, stop, and restart a jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:86 msgid "" "The basics of jail administration, both from inside and outside the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:87 msgid "How to upgrade the different types of jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:88 msgid "How to limit the resources a jail can use." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:89 msgid "The additional per-jail security and feature options." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:90 msgid "How to delegate ZFS datasets to a jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:91 msgid "An incomplete list of the different FreeBSD jail managers." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:93 #, no-wrap msgid "Jail Types" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:97 msgid "" "Some administrators divide jails into different types, although the " "underlying technology is the same. Each administrator will have to assess " "what type of jail to create in each case depending on the problem they have " "to solve." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:99 msgid "" "Below can be found a list of the different types, their characteristics, and " "considerations for use." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:101 #, no-wrap msgid "Thick Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:108 msgid "" "A thick jail is a traditional form of FreeBSD Jail. In a thick jail, a " "complete copy of the base system is replicated within the jail's " "environment. This means that the jail has its own separate instance of the " "FreeBSD base system, including libraries, executables, and configuration " "files. The jail can be thought of as an almost complete standalone FreeBSD " "installation, but running within the confines of the host system. This " "isolation ensures that the processes within the jail are kept separate from " "those on the host and other jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:110 msgid "Advantages of Thick Jails:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:112 msgid "" "High degree of isolation: Processes within the jail are isolated from the " "host system and other jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:113 msgid "" "Independence: Thick jails can have different versions of libraries, " "configurations, and software than the host system or other jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:114 msgid "" "Security: Since the jail contains its own base system, vulnerabilities or " "issues affecting the jail environment will not directly impact the host or " "other jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:116 msgid "Disadvantages of Thick Jails:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:118 msgid "" "Resource overhead: Because each jail maintains its own separate base system, " "thick jails consume more resources compared to thin jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:119 msgid "" "Maintenance: Each jail requires its own maintenance and updates for its base " "system components." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:121 #: documentation/content/en/books/handbook/jails/_index.adoc:765 #, no-wrap msgid "Thin Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:130 msgid "" "A thin jail shares the base system from a template, using either OpenZFS " "snapshots or NullFS mounts. Only a minimal subset of the base system is " "duplicated for each thin jail, resulting in less resource consumption " "compared to a thick jail. The two mechanisms behave differently once the " "jails exist. With the OpenZFS method, each thin jail is created as a clone " "of a template snapshot: an independent copy-on-write copy that shares " "unchanged blocks with the template but diverges as it is modified. Later " "changes to the template do not propagate to existing clones, and each clone " "is maintained and updated individually, much like a thick jail. With the " "NullFS method, each thin jail mounts the template read-only at runtime, so " "the base system is shared live and updating the template updates every jail " "that mounts it. This shared, read-only base is also what gives NullFS thin " "jails less isolation and independence than thick jails, since changes in the " "shared components affect every jail using them simultaneously." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:132 msgid "" "In summary, a FreeBSD Thin Jail is a type of FreeBSD Jail that replicates a " "substantial portion, but not all, of the base system within the isolated " "environment." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:134 msgid "Advantages of Thin Jails:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:138 msgid "" "Resource Efficiency: Thin jails are more resource-efficient compared to " "thick jails. Since they share most of the base system, they consume less " "disk space and memory. This makes it possible to run more jails on the same " "hardware without consuming excessive resources." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:140 msgid "" "Faster Deployment: Creating and launching thin jails is generally faster " "compared to thick jails. This can be particularly advantageous when rapidly " "deploying multiple instances." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:143 msgid "" "Unified Maintenance: With the NullFS method, where the thin jails share a " "single read-only copy of the base system, updates and maintenance of common " "base system components (such as libraries and binaries) only need to be done " "once on the template. This simplifies the maintenance process compared to " "maintaining an individual base system for each thick jail. OpenZFS-clone " "thin jails do not share this benefit: because each clone is independent, " "updates must be applied to each jail individually, as with a thick jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:145 msgid "" "Shared Resources: Thin jails can more easily share common resources such as " "libraries and binaries with the host system. This can potentially lead to " "more efficient disk caching and improved performance for applications within " "the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:147 msgid "Disadvantages of Thin Jails:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:150 msgid "" "Reduced Isolation: The primary disadvantage of thin jails is that they offer " "less isolation compared to thick jails. With the NullFS method in " "particular, jails share a live copy of the template's base system, so " "vulnerabilities or issues affecting those shared components could " "potentially impact multiple jails simultaneously." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:151 msgid "" "Security Concerns: The reduced isolation in thin jails could pose security " "risks, as a compromise in one jail might have a greater potential to affect " "other jails or the host system." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:153 msgid "" "Dependency Conflicts: If multiple thin jails require different versions of " "the same libraries or software, managing dependencies can become complex. " "In some cases, this might require additional effort to ensure compatibility." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:154 msgid "" "Compatibility Challenges: Applications within a thin jail might encounter " "compatibility issues if they assume a certain base system environment that " "differs from the shared components provided by the template." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:156 #: documentation/content/en/books/handbook/jails/_index.adoc:1405 #, no-wrap msgid "Service Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:162 msgid "" "A service jail shares the complete filesystem tree directly with the host " "(the jail root path is [.filename]#/#) and as such can access and modify any " "file on the host, and shares the same user accounts with the host. By " "default it has no access to the network or other resources which are " "restricted in jails, but they can be configured to re-use the network of the " "host and to remove some of the jail-restrictions. The use case for service " "jails is automatic confinement of services/daemons inside a jail with " "minimal configuration, and without any knowledge of the files needed by such " "service/daemon. Service jails are available since FreeBSD 15.0." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:164 msgid "Advantages of Service Jails:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:166 msgid "" "Zero Administration: A service jail ready service needs only one config line " "in [.filename]#/etc/rc.conf#, a service which is not service jails ready " "needs two config lines." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:167 msgid "" "Resource Efficiency: Service jails are more resource efficient than thin " "jails, as they do not need any additional disk space or network resource." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:168 msgid "" "Faster Deployment: Creating and launching service jails is generally faster " "compared to thin jails if only distinct services/daemons shall be jailed and " "no parallel instances of the same service/daemon is needed." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:170 msgid "" "Shared Resources: Service jails share all resources such as libraries and " "binaries with the host system. This can potentially lead to more efficient " "disk caching and improved performance for applications within the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:171 msgid "" "Process Isolation: Service jails isolate a particular service, it can not " "see processes which are not a child of the service jail, even if they run " "within the same user account." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:173 msgid "Disadvantages of Service Jails:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:175 msgid "" "Reduced Isolation: The primary disadvantage of service jails is that they " "offer no filesystem isolation compared to thick or thin jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:176 msgid "" "Security Concerns: The reduced isolation in service jails could pose " "security risks, as a compromise in one jail might have a greater potential " "to affect everything on the host system." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:180 msgid "" "Most of the configuration of jails which is discussed below is not needed " "for service jails. To understand how jails work, it is recommended to " "understand those configuration possibilities. The details about what is " "needed to configure a service jail are in the crossref:jails[service-jails-" "config, Service Jails] section." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:182 #: documentation/content/en/books/handbook/jails/_index.adoc:1043 #, no-wrap msgid "VNET Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:187 msgid "" "A FreeBSD VNET jail is a virtualized environment that allows for the " "isolation and control of network resources for processes running within it. " "It provides a high level of network segmentation and security by creating a " "separate network stack for processes within the jail, ensuring that network " "traffic within the jail is isolated from the host system and other jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:190 msgid "" "In essence, FreeBSD VNET jails add a network configuration mechanism. This " "means a VNET jail can be created as a Thick or Thin Jail." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:192 #: documentation/content/en/books/handbook/jails/_index.adoc:1208 #, no-wrap msgid "Linux Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:197 msgid "" "A FreeBSD Linux Jail is a feature in the FreeBSD operating system that " "enables the use of Linux binaries and applications within a FreeBSD jail. " "This functionality is achieved by incorporating a compatibility layer that " "allows certain Linux system calls and libraries to be translated and " "executed on the FreeBSD kernel. The purpose of a Linux Jail is to " "facilitate the execution of Linux software on a FreeBSD system without " "needing a separate Linux virtual machine or environment." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:199 #, no-wrap msgid "Host Configuration" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:202 msgid "" "Before creating any jail on the host system it is necessary to perform " "certain configuration and obtain some information from the host system." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:204 msgid "" "It will be necessary to configure the man:jail[8] utility, create the " "necessary directories to configure and install jails, obtain information " "from the host's network, and check whether the host uses OpenZFS or UFS as " "its file system." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:208 msgid "" "The FreeBSD version running in the jail can not be newer than the version " "running in the host." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:211 #, no-wrap msgid "Jail Utility" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:214 msgid "The man:jail[8] utility manages jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:216 msgid "To start jails when the system boots, run the following commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:221 #, no-wrap msgid "" "# sysrc jail_enable=\"YES\"\n" "# sysrc jail_parallel_start=\"YES\"\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:226 msgid "" "With `jail_parallel_start`, all configured jails will be started in the " "background." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:230 msgid "" "By default every jail with an entry in the configuration files is started at " "boot. To start only selected jails, list their names in `jail_list`:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:234 #, no-wrap msgid "# sysrc jail_list=\"www db\"\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:239 msgid "" "The names in `jail_list` are separated by spaces and must match the jail " "names defined in [.filename]#/etc/jail.conf# or [.filename]#/etc/jail.conf.d/" "#. Only the listed jails are started at boot, and they are started in the " "order given, so any jail left out of `jail_list` has to be started by hand. " "When `jail_list` is left empty, all jails defined in the configuration files " "are started." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:241 msgid "" "To stop the jails in the reverse of their `jail_list` order at shutdown, set " "`jail_reverse_stop`:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:245 #, no-wrap msgid "# sysrc jail_reverse_stop=\"YES\"\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:253 msgid "" "With `jail_parallel_start` enabled, jails start in the background and the " "`jail_list` order is no longer guaranteed. When one jail must be running " "before another starts, express that relationship with the `depend` parameter " "in [.filename]#/etc/jail.conf# instead of relying on list order. A jail's " "dependencies are created automatically before it starts, and stopped in the " "opposite order, regardless of `jail_list`. The `depend` parameter is " "described in crossref:jails[jail-configuration-files,Jail Configuration " "Files]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:256 #, no-wrap msgid "Networking" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:259 msgid "Networking for FreeBSD jails can be configured several different ways:" msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:260 #, no-wrap msgid "Host Networking Mode (IP Sharing)" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:264 msgid "" "In host networking mode a jail shares the host's network stack instead of " "receiving its own. Sharing the stack does not mean sharing the address: the " "common setup gives the jail its own dedicated `ip4.addr` (and `ip6.addr`) " "that man:jail[8] adds as an alias on the host interface, so the jail and the " "host answer on different addresses over the same stack. Only a jail " "configured with `ip4 = inherit` shares the host's addresses wholesale and " "answers on the host's own address, gaining unrestricted access to every " "address the host holds." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:265 #, no-wrap msgid "Virtual Networks (VNET)" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:269 msgid "" "Virtual Networks are a feature of FreeBSD jails that offer more advanced and " "flexible networking solutions than a basic networking mode like host " "networking. VNET allows the creation of isolated network stacks for each " "jail, providing them with their own separate IP addresses, routing tables, " "and network interfaces. This offers a higher level of network isolation and " "allows jails to function as if they are running on separate virtual machines." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:270 #, no-wrap msgid "The netgraph system" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:273 msgid "" "man:netgraph[4] is a versatile kernel framework for creating custom network " "configurations. It can be used to define how network traffic flows between " "jails and the host system and between different jails." msgstr "" #. type: Title ==== #: documentation/content/en/books/handbook/jails/_index.adoc:275 #, no-wrap msgid "Where a Jail's IP Address Comes From" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:280 msgid "" "A shared-stack jail reaches the network through an address on a host " "interface. The `interface` parameter names that interface, and for every " "address in `ip4.addr` and `ip6.addr` man:jail[8] manages the alias itself: " "as jail(8) puts it, \"an alias for each address will be added to the " "interface before the jail is created, and will be removed from the interface " "after the jail is removed\". Nothing on the host has to pre-configure the " "address." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:282 msgid "" "The interface can also be given per address, so a single line ties an " "address to the interface that should carry it:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:286 #, no-wrap msgid "ip4.addr = \"em0|192.168.1.151/24\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:289 msgid "" "When an address must persist independently of the jail — because another " "service on the host relies on it, or because the `interface` parameter is " "not used — assign it on the host as an rc.conf alias and leave it out of " "jail(8)'s management:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:293 #, no-wrap msgid "# sysrc ifconfig_em0_aliases=\"inet 192.168.1.151/32\"\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:296 msgid "" "The older, numbered form `ifconfig_em0_alias0=\"inet 192.168.1.151/32\"` " "still works, but the `_aliases` form is preferred for new configurations " "because it avoids the fragile requirement that the numbered aliases form an " "unbroken `alias0`, `alias1`, `alias2` sequence." msgstr "" #. type: Title ==== #: documentation/content/en/books/handbook/jails/_index.adoc:298 #, no-wrap msgid "Loopback Addresses in Shared-IP Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:303 msgid "" "A shared-stack jail has no loopback interface of its own. The FreeBSD " "kernel compensates for this: in a non-VNET jail, whenever `127.0.0.1` or " "`::1` is not itself one of the jail's own addresses, the kernel silently " "rewrites both `bind()` and `connect()` on the loopback address to the jail's " "first `ip4.addr` or `ip6.addr`. This behavior is not documented in " "man:jail[8], but it matters, because it carries a security consequence." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:308 msgid "" "Do not assume that binding a service to `localhost` confines it to the " "jail. In a shared-IP jail a daemon told to listen on `127.0.0.1` actually " "binds the jail's first address, which is frequently a LAN-facing one, and so " "becomes reachable from the network." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:312 msgid "" "The standard mitigation is to give the jail a private loopback address and " "list it first. Clone a dedicated loopback interface on the host and assign " "it an address in the `127.0.0.0/8` range (or a private RFC 1918 address):" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:317 #, no-wrap msgid "" "# sysrc cloned_interfaces=\"lo1\"\n" "# sysrc ifconfig_lo1=\"inet 127.0.1.1/32\"\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:320 msgid "" "Then list that address first in the jail's `ip4.addr`, ahead of any routable " "address, so the loopback remap lands on the private address instead of a LAN-" "facing one." msgstr "" #. type: Title ==== #: documentation/content/en/books/handbook/jails/_index.adoc:322 #, no-wrap msgid "Preparing Host Services" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:327 msgid "" "Each jail alias address shares the host's ports. A host daemon bound to the " "wildcard address — shown as `*:port` in listener listings — is therefore " "listening on every jail alias too, and it occupies that port before a jail's " "own service can claim it. Before starting any jails, audit what the host " "already listens on:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:331 #, no-wrap msgid "# sockstat -4 -6 -l\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:334 msgid "" "Restrict each daemon that binds a wildcard address so it uses only the " "host's own address and leaves the jail addresses free:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:337 msgid "" "man:syslogd[8]: set `syslogd_flags=\"-ss\"` in [.filename]#/etc/rc.conf#. A " "single `-s` already runs syslogd in secure mode so it does not listen for " "remote log messages; per syslogd(8), if `-s` \"is specified twice, no " "network socket will be opened at all\", which also stops syslogd from " "sending to remote hosts." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:338 msgid "" "man:sshd[8]: pin `ListenAddress` to the host's address in [.filename]#/etc/" "ssh/sshd_config# instead of leaving it on the default wildcard." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:339 msgid "" "man:ntpd[8] and man:sendmail[8]: bind them to the host address as well " "through their own configuration." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:341 msgid "" "For firewall-level control over which addresses a jail may use, see " "crossref:firewalls[firewalls,Firewalls]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:343 #, no-wrap msgid "Setting Up the Jail Directory Tree" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:346 msgid "There is no specific place to put the files for the jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:349 msgid "" "Some administrators use [.filename]#/jail#, others [.filename]#/usr/jail#, " "and still others [.filename]#/usr/local/jails#. In this chapter " "[.filename]#/usr/local/jails# will be used." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:351 msgid "" "Apart from [.filename]#/usr/local/jails# other directories will be created:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:353 msgid "" "[.filename]#media# will contain the compressed files of the downloaded " "userlands." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:354 msgid "" "[.filename]#templates# will contain the templates when using Thin Jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:355 msgid "[.filename]#containers# will contain the jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:357 msgid "" "When using OpenZFS, execute the following commands to create datasets for " "these directories:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:364 #, no-wrap msgid "" "# zfs create -o mountpoint=/usr/local/jails zroot/jails\n" "# zfs create zroot/jails/media\n" "# zfs create zroot/jails/templates\n" "# zfs create zroot/jails/containers\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:369 msgid "" "In this case, `zroot` was used for the parent dataset, but other datasets " "could have been used." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:373 msgid "" "Creating a separate child dataset per jail is what later enables per-jail " "snapshots, clones, quotas, and dataset delegation. Because each jail " "directory is then its own dataset, OpenZFS can both cap and guarantee its " "disk use with the `quota` and `reservation` properties; see " "crossref:jails[jail-resource-limits,Jail Resource Limits]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:375 msgid "" "When using UFS, execute the following commands to create the directories:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:382 #, no-wrap msgid "" "# mkdir /usr/local/jails/\n" "# mkdir /usr/local/jails/media\n" "# mkdir /usr/local/jails/templates\n" "# mkdir /usr/local/jails/containers\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:385 #, no-wrap msgid "Jail Configuration Files" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:388 msgid "There are two ways to configure jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:391 msgid "" "The first one is to add an entry for each jail to the file [.filename]#/etc/" "jail.conf#. The other option is to create a file for each jail in the " "directory [.filename]#/etc/jail.conf.d/#." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:394 msgid "" "In case a host system has few jails, an entry for each jail can be added in " "the file [.filename]#/etc/jail.conf#. If the host system has many jails, it " "is a good idea to have one configuration file for each jail in the " "[.filename]#/etc/jail.conf.d/# directory." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:396 msgid "" "The files in [.filename]#/etc/jail.conf.d/# must have `.conf` as their " "extension and have to be included in [.filename]#/etc/jail.conf#:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:400 #, no-wrap msgid ".include \"/etc/jail.conf.d/*.conf\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:403 msgid "A typical jail entry would look like this:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:411 #, no-wrap msgid "" "jailname { <.>\n" " # STARTUP/LOGGING\n" " exec.start = \"/bin/sh /etc/rc\"; <.>\n" " exec.stop = \"/bin/sh /etc/rc.shutdown\"; <.>\n" " exec.consolelog = \"/var/log/jail_console_${name}.log\"; <.>\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:416 #, no-wrap msgid "" " # PERMISSIONS\n" " allow.raw_sockets; <.>\n" " exec.clean; <.>\n" " mount.devfs; <.>\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:420 #, no-wrap msgid "" " # HOSTNAME/PATH\n" " host.hostname = \"${name}\"; <.>\n" " path = \"/usr/local/jails/containers/${name}\"; <.>\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:426 #, no-wrap msgid "" " # NETWORK\n" " ip4.addr = 192.168.1.151; <.>\n" " ip6.addr = \"2001:db8::151\"; <.>\n" " interface = em0; <.>\n" "}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:429 msgid "`jailname` - Name of the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:431 msgid "" "`exec.start` - Command(s) to run in the jail environment when a jail is " "created. A typical command to run is \"/bin/sh /etc/rc\"." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:433 msgid "" "`exec.stop` - Command(s) to run in the jail environment before a jail is " "removed. A typical command to run is \"/bin/sh /etc/rc.shutdown\"." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:434 msgid "" "`exec.consolelog` - A file to direct command output (stdout and stderr) to." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:436 msgid "" "`allow.raw_sockets` - Allow creating raw sockets inside the jail. Setting " "this parameter allows utilities like man:ping[8] and man:traceroute[8] to " "operate inside the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:437 msgid "`exec.clean` - Run commands in a clean environment." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:439 msgid "" "`mount.devfs` - Mount a man:devfs[5] filesystem on the chrooted [.filename]#/" "dev# directory to restrict the devices visible inside the jail. It applies " "the ruleset named by the `devfs_ruleset` parameter, or, when that parameter " "is left at its default of `0`, the `mount.devfs` fallback of ruleset 4, " "`devfsrules_jail`, which hides every host device except a minimal, jail-safe " "set (see crossref:jails[jail-conf-devfs, Devfs Rulesets])." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:440 msgid "`host.hostname` - The hostname of the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:442 msgid "" "`path` - The directory which is to be the root of the jail. Any commands " "that are run inside the jail, either by jail or from man:jexec[8], are run " "from this directory." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:447 msgid "" "`ip4.addr` - One IPv4 address, or a comma-separated list of addresses, " "assigned to the jail. Setting `ip4.addr` implies `ip4 = new`; `ip4` itself " "is not left at a standalone default. The `ip4` parameter accepts three " "values: `new` restricts the jail to the addresses listed in `ip4.addr`, " "`inherit` gives the jail unrestricted access to every IPv4 address of the " "host, and `disable` turns off IPv4 in the jail entirely. A jail with " "neither `ip4` nor `ip4.addr` set behaves like `inherit`, and `interface` and " "`ip4.addr` have no effect under `inherit`. In a jail with several " "addresses, `ip4.saddrsel` lets the kernel choose the source address for " "outgoing connections on unbound sockets, while `ip4.nosaddrsel` forces the " "first address in the list." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:450 msgid "" "`ip6.addr` - One IPv6 address, or a comma-separated list of addresses, " "assigned to the jail. The `ip6` parameter takes the same `new`, `inherit`, " "and `disable` values as `ip4`, with `ip6.saddrsel` and `ip6.nosaddrsel` " "controlling source-address selection. Use `ip6 = disable` for an IPv4-only " "jail, or `ip4 = disable` for an IPv6-only one." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:452 msgid "" "`interface` - A network interface to add the jail's IP addresses. Usually " "the host interface." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:459 msgid "" "A jail has no virtual console: man:init[8] and man:getty[8] do not run " "inside it, so there is nothing to attach to interactively. The " "`exec.consolelog` file captures only the standard output and standard error " "of the `exec.*` commands, that is, the output of the [.filename]#/etc/rc# " "startup and [.filename]#/etc/rc.shutdown# scripts. It is not an interactive " "console; for that, use man:jexec[8] (see crossref:jails[access-jail, Access " "a Jail]) or run man:sshd[8] inside the jail. The jail's own daemons send " "their later output to the jail's syslog." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:465 msgid "" "The `exec.consolelog` files grow without bound. Rotate them with " "man:newsyslog[8] by adding a single glob entry, for example in [.filename]#/" "etc/newsyslog.conf.d/jail#:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:469 #, no-wrap msgid "/var/log/jail_console_*.log 640 7 100 * J\n" msgstr "" #. type: Title ==== #: documentation/content/en/books/handbook/jails/_index.adoc:473 #, no-wrap msgid "Global Settings, Wildcards and Variables" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:477 msgid "" "Parameters set outside any jail block are wildcard defaults: " "man:jail.conf[5] applies them to every jail, exactly as if they were written " "in a `*` wildcard section. Setting the shared parameters once keeps each " "jail block short." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:480 msgid "" "A name preceded by a dollar sign, and optionally enclosed in braces, is " "replaced with the value of that parameter or variable. The built-in `${name}" "` expands to the jail's own name, and a custom variable is defined just like " "a parameter but with a leading dollar sign." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:482 msgid "" "The following [.filename]#/etc/jail.conf# defines a common header once and " "overrides only what differs per jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:494 #, no-wrap msgid "" "# Shared defaults applied to every jail\n" "exec.start = \"/bin/sh /etc/rc\";\n" "exec.stop = \"/bin/sh /etc/rc.shutdown\";\n" "exec.consolelog = \"/var/log/jail_console_${name}.log\";\n" "exec.clean;\n" "mount.devfs;\n" "host.hostname = \"${name}\";\n" "path = \"/usr/local/jails/containers/${name}\";\n" "interface = em0;\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:498 #, no-wrap msgid "" "www {\n" " ip4.addr = 192.168.1.151;\n" "}\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:503 #, no-wrap msgid "" "db {\n" " host.hostname = \"database.example.com\";\n" " ip4.addr = 192.168.1.152;\n" "}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:506 msgid "" "Here `www` inherits everything from the header and sets only its address, " "while `db` also overrides `host.hostname`." msgstr "" #. type: Title ==== #: documentation/content/en/books/handbook/jails/_index.adoc:508 #, no-wrap msgid "Command Hooks" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:512 msgid "" "man:jail[8] runs a jail through a sequence of lifecycle hooks, and it " "matters whether each one runs in the host environment or inside the jail. " "In creation order:" msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:513 #, no-wrap msgid "`exec.prestart`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:514 msgid "Runs in the host environment before the jail is created." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:514 #, no-wrap msgid "`exec.created`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:515 msgid "" "Runs in the host environment after the jail exists but before any process " "starts inside it." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:515 #, no-wrap msgid "`exec.start`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:516 msgid "" "Runs inside the jail, typically `/bin/sh /etc/rc` to bring up its services." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:516 #, no-wrap msgid "`exec.poststart`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:517 msgid "Runs in the host environment after the jail has started." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:519 msgid "Shutdown runs the mirror image:" msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:520 #, no-wrap msgid "`exec.prestop`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:521 msgid "Runs in the host environment before the jail is stopped." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:521 #, no-wrap msgid "`exec.stop`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:522 msgid "Runs inside the jail, typically `/bin/sh /etc/rc.shutdown`." msgstr "" #. type: Labeled list #: documentation/content/en/books/handbook/jails/_index.adoc:522 #, no-wrap msgid "`exec.poststop`" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:523 msgid "" "Runs in the host environment after the jail has stopped, to tear down " "whatever `exec.prestart` set up." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:525 msgid "A hook may be assigned more than one command by appending with `+=`:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:529 #, no-wrap msgid "exec.poststart += \"logger jail ${name} started\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:533 msgid "" "`exec.timeout` caps how long man:jail[8] waits for a command to finish, and " "`exec.consolelog` captures the output of these commands. The VNET section " "(crossref:jails[creating-vnet-jail, VNET Jails]) uses `exec.prestart` and " "`exec.poststop` to build and tear down each jail's network plumbing on the " "host." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:536 msgid "" "Where hooks order commands within a single jail, the `depend` parameter " "orders whole jails. Writing `depend = otherjail;` tells man:jail[8] that " "this jail requires `otherjail`: the dependency is created first, up to the " "completion of its last `exec.poststart` command, before this jail is " "created, and the jails are torn down in the reverse order." msgstr "" #. type: Title ==== #: documentation/content/en/books/handbook/jails/_index.adoc:538 #, no-wrap msgid "Devfs Rulesets" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:544 msgid "" "Every jail that sets `mount.devfs` gets a devfs ruleset that decides which " "device nodes appear under its [.filename]#/dev#, either the one named by the " "`devfs_ruleset` parameter or, when that parameter is unset, the " "`mount.devfs` default of ruleset 4. man:devfs.rules[5] defines named " "rulesets in [.filename]#/etc/defaults/devfs.rules#. Two of them are meant " "for jails: `devfsrules_jail`, ruleset 4, is the standard minimal device set " "for a jail, and `devfsrules_jail_vnet`, ruleset 5, adds [.filename]#/dev/pf# " "so a VNET jail can run its own firewall. The VNET jail examples set " "`devfs_ruleset = 5` and the Linux jail example sets `devfs_ruleset = 4`; the " "classic and thin-jail examples set only `mount.devfs` and so use its default " "of ruleset 4." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:547 msgid "" "To expose an extra device, write a custom ruleset in [.filename]#/etc/" "devfs.rules# that includes one of the stock rulesets and unhides what it " "needs. The following ruleset starts from `devfsrules_jail` and additionally " "unhides the man:bpf[4] devices:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:553 #, no-wrap msgid "" "[devfsrules_jail_bpf=100]\n" "add include $devfsrules_jail\n" "add path 'bpf*' unhide\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:556 msgid "" "Reload the rules, then reference the new ruleset by its number in the jail's " "configuration:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:560 #, no-wrap msgid "# service devfs restart\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:565 #, no-wrap msgid "devfs_ruleset = 100;\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:568 msgid "" "Rulesets in [.filename]#/etc/devfs.rules# override same-numbered rulesets in " "[.filename]#/etc/defaults/devfs.rules#; otherwise the two files are " "effectively merged." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:570 msgid "" "More information about configuration variables can be found in man:jail[8] " "and man:jail.conf[5]." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:572 #, no-wrap msgid "Classic Jail (Thick Jail)" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:576 msgid "" "These jails resemble a real FreeBSD system. They can be managed more or " "less like a normal host system and updated independently." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:578 #, no-wrap msgid "Creating a Classic Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:581 msgid "" "In principle, a jail only needs a hostname, a root directory, an IP address, " "and a userland." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:583 msgid "" "The userland for the jail can be obtained from the official FreeBSD download " "servers." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:585 msgid "Execute the following command to download the userland:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:589 #: documentation/content/en/books/handbook/jails/_index.adoc:795 #: documentation/content/en/books/handbook/jails/_index.adoc:899 #, no-wrap msgid "# fetch https://download.freebsd.org/releases/amd64/amd64/{rel-latest}-RELEASE/base.txz -o /usr/local/jails/media/{rel-latest}-RELEASE-base.txz\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:592 msgid "" "Once the download is complete, it will be necessary to extract the contents " "into the jail directory." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:594 msgid "" "Execute the following commands to extract the userland into the jail's " "directory:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:599 #, no-wrap msgid "" "# mkdir -p /usr/local/jails/containers/classic\n" "# tar -xf /usr/local/jails/media/{rel-latest}-RELEASE-base.txz -C /usr/local/jails/containers/classic --unlink\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:602 msgid "" "With the userland extracted in the jail directory, it will be necessary to " "copy the timezone and DNS server files:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:607 #, no-wrap msgid "" "# cp /etc/resolv.conf /usr/local/jails/containers/classic/etc/resolv.conf\n" "# cp /etc/localtime /usr/local/jails/containers/classic/etc/localtime\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:610 msgid "" "With the files copied, the next thing to do is update to the latest patch " "level by executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:614 #, no-wrap msgid "# freebsd-update -b /usr/local/jails/containers/classic/ fetch install\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:618 #: documentation/content/en/books/handbook/jails/_index.adoc:839 msgid "" "The last step is to configure the jail. It will be necessary to add an " "entry to the configuration file [.filename]#/etc/jail.conf# or in " "[.filename]#jail.conf.d# with the parameters of the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:620 #: documentation/content/en/books/handbook/jails/_index.adoc:841 msgid "An example would be the following:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:628 #, no-wrap msgid "" "classic {\n" " # STARTUP/LOGGING\n" " exec.start = \"/bin/sh /etc/rc\";\n" " exec.stop = \"/bin/sh /etc/rc.shutdown\";\n" " exec.consolelog = \"/var/log/jail_console_${name}.log\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:633 #: documentation/content/en/books/handbook/jails/_index.adoc:748 #: documentation/content/en/books/handbook/jails/_index.adoc:854 #: documentation/content/en/books/handbook/jails/_index.adoc:1008 #, no-wrap msgid "" " # PERMISSIONS\n" " allow.raw_sockets;\n" " exec.clean;\n" " mount.devfs;\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:637 #: documentation/content/en/books/handbook/jails/_index.adoc:752 #: documentation/content/en/books/handbook/jails/_index.adoc:858 #: documentation/content/en/books/handbook/jails/_index.adoc:1316 #, no-wrap msgid "" " # HOSTNAME/PATH\n" " host.hostname = \"${name}\";\n" " path = \"/usr/local/jails/containers/${name}\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:642 #, no-wrap msgid "" " # NETWORK\n" " ip4.addr = 192.168.1.151;\n" " interface = em0;\n" "}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:645 #: documentation/content/en/books/handbook/jails/_index.adoc:866 #: documentation/content/en/books/handbook/jails/_index.adoc:1036 msgid "Execute the following command to start the jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:649 #, no-wrap msgid "# service jail start classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:652 #: documentation/content/en/books/handbook/jails/_index.adoc:874 msgid "" "More information on how to manage jails can be found in the section " "crossref:jails[jail-management, Jail Management]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:654 #, no-wrap msgid "Obtaining the Jail Userland" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:658 msgid "" "The fetch-and-extract procedure shown above is the traditional way to " "populate a jail's root directory, but it is not the only one. The same " "userland can be installed with man:bsdinstall[8], from base-system packages, " "or from a locally built source tree." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:661 msgid "" "man:bsdinstall[8] provides a dedicated `jail` target that sets up a new " "userland at the given directory for use with man:jail[8]. It fetches and " "extracts the distribution sets without installing a kernel, skipping the " "disk partitioning and network steps of a normal installation, which makes it " "a one-command, scriptable alternative to the manual fetch and man:tar[1] " "sequence:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:665 #, no-wrap msgid "# bsdinstall jail /usr/local/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:669 msgid "" "The `jail` target installs the base distribution ([.filename]#base.txz#) by " "default. On FreeBSD 15.0 and later man:bsdinstall[8] can also populate the " "root from base-system packages with its `pkgbase` target; the pkg-based " "method is described next." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:672 msgid "" "Starting with FreeBSD 15.0 the base system is also published as packages, so " "a jail userland can be installed entirely with man:pkg[8] from the `FreeBSD-" "base` repository. Point man:pkg[8] at the jail's root directory with the " "global `--rootdir` option and install the jail variant of the base set:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:676 #, no-wrap msgid "# pkg --rootdir /usr/local/jails/containers/classic install -r FreeBSD-base FreeBSD-set-base-jail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:680 msgid "" "Use `FreeBSD-set-minimal-jail` instead of `FreeBSD-set-base-jail` for a " "minimal userland. A jail installed this way is afterwards patched and " "upgraded with man:pkg[8] rather than man:freebsd-update[8]; see " "crossref:jails[jail-upgrade-pkgbase, Upgrading pkgbase Jails]." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:687 msgid "" "Base-system packages are a technology preview in FreeBSD 15.0. The `FreeBSD-" "base` repository is defined in [.filename]#/etc/pkg/FreeBSD.conf# but " "disabled by default, so select it explicitly with `install -r FreeBSD-" "base`. The target root directory and its [.filename]#var/cache/pkg# and " "[.filename]#var/db/pkg# subdirectories may need to be created first. The " "traditional [.filename]#base.txz# distribution is still published for " "FreeBSD 15.0, so the fetch-and-extract method continues to work there as " "well." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:691 msgid "" "A userland built from a source tree can be installed into a jail's root " "directory with the `DESTDIR` variable, which is the way to run a `-STABLE` " "or custom-built userland in a jail. After building the world, install it " "and the remaining distribution files into the jail directory:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:698 #, no-wrap msgid "" "# cd /usr/src\n" "# make buildworld\n" "# make installworld DESTDIR=/usr/local/jails/containers/classic\n" "# make distribution DESTDIR=/usr/local/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:703 msgid "" "`make distribution` installs the default configuration files under the " "jail's [.filename]#/etc# and is run only once, when populating the jail; " "repeating it during an update would overwrite the configuration inside the " "jail. To update such a jail from source, follow the same sequence as for " "the host: run `installworld` with the same `DESTDIR`, merge the " "configuration files with `etcupdate -D` pointed at the jail's root " "directory, and remove obsolete files and libraries with `make delete-old " "delete-old-libs`, again with the same `DESTDIR`, rather than using " "man:freebsd-update[8]. See crossref:cutting-edge[makeworld, Updating " "FreeBSD from Source] for the complete source-update procedure." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:705 #, no-wrap msgid "Cloning a Jail as a Template" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:708 msgid "" "Once a thick jail is fully configured, with packages installed, services " "enabled, and local configuration in place, it can serve as a template image: " "a template from which many identical jails are deployed almost instantly." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:711 msgid "" "On OpenZFS this is done by snapshotting the configured jail's dataset and " "cloning it. This requires the source jail to live on its own dataset, so " "create it with `zfs create` rather than the `mkdir` used in the classic-jail " "procedure above:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:715 #, no-wrap msgid "# zfs create -p zroot/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:718 msgid "" "Stop the jail before snapshotting so the image is consistent, then snapshot " "and clone the dataset once for each new jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:724 #, no-wrap msgid "" "# service jail stop classic\n" "# zfs snapshot zroot/jails/containers/classic@template\n" "# zfs clone zroot/jails/containers/classic@template zroot/jails/containers/web1\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:727 msgid "On a UFS host, copy the configured jail's directory tree instead:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:731 #, no-wrap msgid "# cp -a /usr/local/jails/containers/classic /usr/local/jails/containers/web1\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:735 msgid "" "Each clone needs its own entry in [.filename]#/etc/jail.conf#, or in " "[.filename]#jail.conf.d#, with a unique name, path, and IP address. Because " "the `path` and `host.hostname` parameters in the example above are derived " "from the block name with `${name}`, only the block name and the address " "differ:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:743 #, no-wrap msgid "" "web1 {\n" " # STARTUP/LOGGING\n" " exec.start = \"/bin/sh /etc/rc\";\n" " exec.stop = \"/bin/sh /etc/rc.shutdown\";\n" " exec.consolelog = \"/var/log/jail_console_${name}.log\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:757 #, no-wrap msgid "" " # NETWORK\n" " ip4.addr = 192.168.1.152;\n" " interface = em0;\n" "}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:763 msgid "" "A template-image clone differs from a thin jail (crossref:jails[thin-jail, " "Thin Jails]). A thin jail keeps sharing a read-only base and is maintained " "once at the template, whereas each template-image clone is a full, " "independently writable copy that is patched and upgraded on its own as " "described in crossref:jails[jail-upgrading, Jail Upgrading]. An OpenZFS " "clone starts as a space-efficient copy-on-write copy that shares blocks with " "the snapshot, and it keeps a dependency on that origin snapshot until `zfs " "promote` severs it. For a fully independent copy, or to replicate a jail to " "another pool or host, use `zfs send` piped to `zfs receive` instead of `zfs " "clone`." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:771 msgid "" "Although Thin Jails use the same technology as Thick Jails, the creation " "procedure is different. Thin jails can be created using OpenZFS snapshots " "or using templates and NullFS. The use of OpenZFS snapshots and templates " "using NullFS have certain advantages over classic jails, such as being able " "to create them faster from snapshots or being able to update multiple jails " "using NullFS." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:773 #, no-wrap msgid "Creating a Thin Jail Using OpenZFS Snapshots" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:776 msgid "" "Due to the good integration between FreeBSD and OpenZFS it is very easy to " "create new Thin Jails using OpenZFS Snapshots." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:778 msgid "" "To create a Thin Jail using OpenZFS Snapshots the first step is to create " "the jail directory tree by following the instructions in crossref:jails[host-" "configuration-directories, \"Setting Up the Jail Directory Tree\"]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:782 msgid "" "Next, create a template. Templates will only be used to create new jails. " "For this reason they are created in \"read-only\" mode so that jails are " "created with an immutable base." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:784 msgid "To create the dataset for the template, execute the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:788 #, no-wrap msgid "# zfs create -p zroot/jails/templates/{rel-latest}-RELEASE\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:791 #: documentation/content/en/books/handbook/jails/_index.adoc:895 msgid "Then execute the following command to download the userland:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:798 #: documentation/content/en/books/handbook/jails/_index.adoc:902 msgid "" "Once the download is complete, it will be necessary to extract the contents " "in the template directory by executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:802 #, no-wrap msgid "# tar -xf /usr/local/jails/media/{rel-latest}-RELEASE-base.txz -C /usr/local/jails/templates/{rel-latest}-RELEASE --unlink\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:805 msgid "" "With the userland extracted in the templates directory, it will be necessary " "to copy the timezone and DNS server files to the template directory by " "executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:810 #, no-wrap msgid "" "# cp /etc/resolv.conf /usr/local/jails/templates/{rel-latest}-RELEASE/etc/resolv.conf\n" "# cp /etc/localtime /usr/local/jails/templates/{rel-latest}-RELEASE/etc/localtime\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:813 msgid "" "The next thing to do is update to the latest patch level by executing the " "following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:817 #: documentation/content/en/books/handbook/jails/_index.adoc:1909 #, no-wrap msgid "# freebsd-update -b /usr/local/jails/templates/{rel-latest}-RELEASE/ fetch install\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:820 msgid "Once the update is finished, the template is ready." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:822 msgid "" "To create an OpenZFS Snapshot from the template, execute the following " "command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:826 #, no-wrap msgid "# zfs snapshot zroot/jails/templates/{rel-latest}-RELEASE@base\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:829 msgid "" "Once the OpenZFS Snapshot has been created, infinite jails can be created " "using the OpenZFS clone function." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:831 msgid "To create a Thin Jail named `thinjail`, execute the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:835 #, no-wrap msgid "# zfs clone zroot/jails/templates/{rel-latest}-RELEASE@base zroot/jails/containers/thinjail\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:849 #: documentation/content/en/books/handbook/jails/_index.adoc:1003 #, no-wrap msgid "" "thinjail {\n" " # STARTUP/LOGGING\n" " exec.start = \"/bin/sh /etc/rc\";\n" " exec.stop = \"/bin/sh /etc/rc.shutdown\";\n" " exec.consolelog = \"/var/log/jail_console_${name}.log\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:863 #, no-wrap msgid "" " # NETWORK\n" " ip4 = inherit;\n" " interface = em0;\n" "}\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:870 #: documentation/content/en/books/handbook/jails/_index.adoc:1040 #, no-wrap msgid "# service jail start thinjail\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:876 #, no-wrap msgid "Creating a Thin Jail Using NullFS" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:879 msgid "" "A jail can be created with reduced duplication of system files by using the " "Thin Jail technique and using NullFS to selectively share specific " "directories from the host system into the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:881 msgid "" "The first step is to create the dataset to save the template, execute the " "following command if using OpenZFS:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:885 #, no-wrap msgid "# zfs create -p zroot/jails/templates/{rel-latest}-RELEASE-base\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:888 msgid "Or this one if using UFS:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:892 #, no-wrap msgid "# mkdir /usr/local/jails/templates/{rel-latest}-RELEASE-base\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:906 #, no-wrap msgid "# tar -xf /usr/local/jails/media/{rel-latest}-RELEASE-base.txz -C /usr/local/jails/templates/{rel-latest}-RELEASE-base --unlink\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:909 msgid "" "Once the userland is extracted in the templates directory, it will be " "necessary to copy the timezone and DNS server files to the template " "directory by executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:914 #, no-wrap msgid "" "# cp /etc/resolv.conf /usr/local/jails/templates/{rel-latest}-RELEASE-base/etc/resolv.conf\n" "# cp /etc/localtime /usr/local/jails/templates/{rel-latest}-RELEASE-base/etc/localtime\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:917 msgid "" "With the files moved to the template, the next thing to do is update to the " "latest patch level by executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:921 #, no-wrap msgid "# freebsd-update -b /usr/local/jails/templates/{rel-latest}-RELEASE-base/ fetch install\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:925 msgid "" "In addition to the base template, it is also necessary to create a directory " "where the `skeleton` will be located. Some directories will be copied from " "the template to the `skeleton`." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:927 msgid "" "Execute the following command to create the dataset for the `skeleton` in " "case of using OpenZFS:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:931 #, no-wrap msgid "# zfs create -p zroot/jails/templates/{rel-latest}-RELEASE-skeleton\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:934 msgid "Or this one in case of using UFS:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:938 #, no-wrap msgid "# mkdir /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:942 msgid "" "Then create the `skeleton` directories. The `skeleton` directories will " "hold the local directories of the jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:944 msgid "Execute the following commands to create the directories:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:954 #, no-wrap msgid "" "# mkdir -p /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/home\n" "# mkdir -p /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/usr\n" "# mv /usr/local/jails/templates/{rel-latest}-RELEASE-base/etc /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/etc\n" "# mv /usr/local/jails/templates/{rel-latest}-RELEASE-base/usr/local /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/usr/local\n" "# mv /usr/local/jails/templates/{rel-latest}-RELEASE-base/tmp /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/tmp\n" "# mv /usr/local/jails/templates/{rel-latest}-RELEASE-base/var /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/var\n" "# mv /usr/local/jails/templates/{rel-latest}-RELEASE-base/root /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton/root\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:957 msgid "" "The next step is to create the symlinks to the `skeleton` by executing the " "following commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:968 #, no-wrap msgid "" "# cd /usr/local/jails/templates/{rel-latest}-RELEASE-base/\n" "# mkdir skeleton\n" "# ln -s skeleton/etc etc\n" "# ln -s skeleton/home home\n" "# ln -s skeleton/root root\n" "# ln -s ../skeleton/usr/local usr/local\n" "# ln -s skeleton/tmp tmp\n" "# ln -s skeleton/var var\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:971 msgid "" "With the `skeleton` ready, it will be necessary to copy the data to the jail " "directory." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:973 msgid "" "In case of using OpenZFS, OpenZFS snapshots can be used to easily create as " "many jails as necessary by executing the following commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:978 #, no-wrap msgid "" "# zfs snapshot zroot/jails/templates/{rel-latest}-RELEASE-skeleton@base\n" "# zfs clone zroot/jails/templates/{rel-latest}-RELEASE-skeleton@base zroot/jails/containers/thinjail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:981 msgid "" "In case of using UFS the man:cp[1] program can be used by executing the " "following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:985 #, no-wrap msgid "# cp -R /usr/local/jails/templates/{rel-latest}-RELEASE-skeleton /usr/local/jails/containers/thinjail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:988 msgid "" "Then create the directory in which the base template and the skeleton will " "be mounted:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:992 #, no-wrap msgid "# mkdir -p /usr/local/jails/thinjail-nullfs-base\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:995 msgid "" "Add a jail entry in [.filename]#/etc/jail.conf# or a file in " "[.filename]#jail.conf.d# as follows:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1012 #, no-wrap msgid "" " # HOSTNAME/PATH\n" " host.hostname = \"${name}\";\n" " path = \"/usr/local/jails/${name}-nullfs-base\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1016 #, no-wrap msgid "" " # NETWORK\n" " ip4.addr = 192.168.1.153;\n" " interface = em0;\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1020 #, no-wrap msgid "" " # MOUNT\n" " mount.fstab = \"/usr/local/jails/${name}-nullfs-base.fstab\";\n" "}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1023 msgid "" "Then create the [.filename]#/usr/local/jails/thinjail-nullfs-base.fstab# " "file as follows:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1028 #, no-wrap msgid "" "/usr/local/jails/templates/{rel-latest}-RELEASE-base /usr/local/jails/thinjail-nullfs-base/ nullfs ro 0 0\n" "/usr/local/jails/containers/thinjail /usr/local/jails/thinjail-nullfs-base/skeleton nullfs rw 0 0\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1034 msgid "" "The [.filename]#fstab# file controls how man:mount_nullfs[8] presents the " "base template and the skeleton inside the jail. The base template is " "mounted read-only (`ro`) so that every NullFS jail shares one immutable copy " "of the base system. The per-jail skeleton is mounted read-write (`rw`), " "which is where each jail keeps its own writable [.filename]#/etc#, " "[.filename]#/var#, [.filename]#/usr/local#, and other local directories. " "Because all jails share that single read-only base template, updating the " "one template updates every NullFS jail at once, in contrast to independent " "OpenZFS clones which must each be updated separately." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1046 msgid "" "FreeBSD VNET Jails have their own distinct networking stack, including " "interfaces, IP addresses, routing tables, and firewall rules." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1048 msgid "" "The first step to create a VNET jail is to create the man:bridge[4] by " "executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1052 #, no-wrap msgid "# ifconfig bridge create\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1055 #: documentation/content/en/books/handbook/jails/_index.adoc:1466 #: documentation/content/en/books/handbook/jails/_index.adoc:1482 #: documentation/content/en/books/handbook/jails/_index.adoc:1510 msgid "The output should be similar to the following:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1059 #, no-wrap msgid "bridge0\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1067 msgid "" "Assigning an IP address to an interface that is a member of a bridge is " "deprecated. Assign the host's address to `bridge0` itself rather than to " "`em0`, exactly as the [.filename]#/etc/rc.conf# block below does. Such " "configurations keep working for now: FreeBSD 15.0 logs a kernel warning when " "an interface that carries an address is added to a bridge, and refuses it " "with `EINVAL` only when the `net.link.bridge.member_ifaddrs` sysctl is " "changed from its default of `1` to `0`. man:bridge[4] announces the removal " "of this sysctl in FreeBSD 16.0, after which addresses on bridge members will " "no longer be permitted." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1070 msgid "" "With the `bridge` created, it will be necessary to attach it to the `em0` " "interface and bring both of them up by executing the following commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1075 #, no-wrap msgid "" "# ifconfig bridge0 addm em0 up\n" "# ifconfig em0 up\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1078 msgid "" "To make this setting persist across reboots, add the following lines to " "[.filename]#/etc/rc.conf#:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1085 #, no-wrap msgid "" "defaultrouter=\"192.168.1.1\"\n" "cloned_interfaces=\"bridge0\"\n" "ifconfig_bridge0=\"inet 192.168.1.150/24 addm em0 up\"\n" "ifconfig_em0=\"up\"\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1088 msgid "" "For more information on bridging, see crossref:advanced-networking[network-" "bridging, Network Bridging]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1090 msgid "The next step is to create the jail as indicated above." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1094 msgid "" "Either the crossref:jails[classic-jail, Classic Jail (Thick Jail)] procedure " "or the crossref:jails[thin-jail, Thin Jails] procedure can be used. The " "only thing that will change is the configuration in the [.filename]#/etc/" "jail.conf# file." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1096 msgid "" "The path [.filename]#/usr/local/jails/containers/vnet# will be used as an " "example for the created jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1098 msgid "The following is an example configuration for a VNET jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1104 #, no-wrap msgid "" "vnet {\n" " # STARTUP/LOGGING\n" " exec.consolelog = \"/var/log/jail_console_${name}.log\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1110 #, no-wrap msgid "" " # PERMISSIONS\n" " allow.raw_sockets;\n" " exec.clean;\n" " mount.devfs;\n" " devfs_ruleset = 5;\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1114 #, no-wrap msgid "" " # PATH/HOSTNAME\n" " path = \"/usr/local/jails/containers/${name}\";\n" " host.hostname = \"${name}\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1118 #, no-wrap msgid "" " # VNET/VIMAGE\n" " vnet;\n" " vnet.interface = \"${epair}b\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1125 #, no-wrap msgid "" " # NETWORKS/INTERFACES\n" " $id = \"154\"; <.>\n" " $ip = \"192.168.1.${id}/24\";\n" " $gateway = \"192.168.1.1\";\n" " $bridge = \"bridge0\"; <.>\n" " $epair = \"epair${id}\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1137 #, no-wrap msgid "" " # ADD TO bridge INTERFACE\n" " exec.prestart = \"/sbin/ifconfig ${epair} create up\";\n" " exec.prestart += \"/sbin/ifconfig ${epair}a up descr jail:${name}\";\n" " exec.prestart += \"/sbin/ifconfig ${bridge} addm ${epair}a up\";\n" " exec.start += \"/sbin/ifconfig ${epair}b ${ip} up\";\n" " exec.start += \"/sbin/route add default ${gateway}\";\n" " exec.start += \"/bin/sh /etc/rc\";\n" " exec.stop = \"/bin/sh /etc/rc.shutdown\";\n" " exec.poststop = \"/sbin/ifconfig ${bridge} deletem ${epair}a\";\n" " exec.poststop += \"/sbin/ifconfig ${epair}a destroy\";\n" "}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1140 msgid "" "A per-jail *unique* number used to derive both the epair device name (`epair$" "{id}`) and the last octet of the jail's address (`192.168.1.${id}`); give " "each jail on the bridge a different value." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1141 msgid "Refers to the bridge created previously." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1145 msgid "" "The `vnet.interface` parameter names the interface that man:jail[8] moves " "into the jail's network stack once the jail is created, here the jail side " "of the epair, `${epair}b`. That interface disappears from the host while " "the jail runs and is automatically released back to the host when the jail " "stops. A physical network card or an SR-IOV virtual function can be handed " "to a jail the same way, giving it dedicated networking without a bridge or " "an epair." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1149 msgid "" "The `devfs_ruleset = 5` line applies the `devfsrules_jail_vnet` ruleset from " "[.filename]#/etc/defaults/devfs.rules#, which extends the default jail " "ruleset by exposing [.filename]#/dev/pf#. A VNET jail can therefore run its " "own man:pf[4] firewall with `pf_enable=\"YES\"` and a private " "[.filename]#pf.conf#, independent of the host. See crossref:jails[jail-conf-" "devfs, Devfs Rulesets] for how rulesets are defined and " "crossref:firewalls[firewalls, Firewalls] for pf itself." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1151 #, no-wrap msgid "Automating VNET Networking with jib" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1155 msgid "" "Wiring up an epair and attaching it to the bridge by hand in `exec.prestart` " "and `exec.poststop`, as shown above, becomes tedious across many jails. The " "base system ships a helper script, [.filename]#/usr/share/examples/jails/" "jib#, that performs the same plumbing automatically." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1157 msgid "" "Reference it from the jail's hooks instead of the five hand-rolled " "man:ifconfig[8] lines:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1162 #, no-wrap msgid "" " exec.prestart += \"jib addm ${name} em0\";\n" " exec.poststop += \"jib destroy ${name}\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1164 #, no-wrap msgid " vnet.interface = \"e0b_${name}\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1170 msgid "" "`jib addm` creates an epair whose host side is named `e0a_` and whose " "jail side is `e0b_`, then attaches the host side to a bridge that it " "creates automatically, named after the member interface (for `em0` the " "bridge is `em0bridge`). Name that jail side in `vnet.interface`. When the " "jail stops, `jib destroy` removes the epair. The script also provides a " "`jib show` subcommand to list the interfaces it manages." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1172 #, no-wrap msgid "Netgraph VNET Networking with jng" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1176 msgid "" "The third networking mode mentioned in the crossref:jails[jails-networking, " "Networking] overview uses man:netgraph[4] instead of man:bridge[4] and " "epair. The base system ships a second helper, [.filename]#/usr/share/" "examples/jails/jng#, that builds an `ng_bridge` connected to an `ng_eiface` " "for each jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1181 #, no-wrap msgid "" " exec.prestart += \"jng bridge ${name} em0\";\n" " exec.poststop += \"jng shutdown ${name}\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1183 #, no-wrap msgid " vnet.interface = \"ng0_${name}\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1187 msgid "" "`jng bridge` creates the netgraph nodes and a jail-side interface named " "`ng0_`, which is named in `vnet.interface`; `jng shutdown` tears the " "topology down when the jail stops. The result is functionally equivalent to " "the epair-and-bridge setup, but built on netgraph nodes rather than " "man:bridge[4]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1189 #, no-wrap msgid "Running a Firewall and DHCP inside a VNET Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1193 msgid "" "Because `devfs_ruleset = 5` exposes [.filename]#/dev/pf#, a VNET jail can " "run its own firewall. Enable it inside the jail exactly as on any host, " "with `pf_enable=\"YES\"` in the jail's [.filename]#/etc/rc.conf# and its own " "[.filename]#/etc/pf.conf#." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1197 msgid "" "Ruleset 5 does not expose [.filename]#/dev/bpf#, however. A VNET jail that " "obtains its address over DHCP, for example with " "`ifconfig_e0b_myjail=\"SYNCDHCP\"` in its [.filename]#/etc/rc.conf#, runs " "man:dhclient[8], which needs bpf and therefore fails under ruleset 5. " "Following the recipe in crossref:jails[jail-conf-devfs,Devfs Rulesets], " "define a custom ruleset in [.filename]#/etc/devfs.rules# that starts from " "`devfsrules_jail_vnet` and additionally unhides the bpf devices:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1203 #, no-wrap msgid "" "[devfsrules_jail_vnet_dhcp=101]\n" "add include $devfsrules_jail_vnet\n" "add path 'bpf*' unhide\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1206 msgid "" "After running `service devfs restart` on the host, point the jail at the new " "ruleset with `devfs_ruleset = 101;`." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1214 msgid "" "FreeBSD can run a Linux userland inside a jail using " "crossref:linuxemu[linuxemu,Linux Binary Compatibility] and package:sysutils/" "debootstrap[]. Jails do not have a kernel. They run on the host's kernel. " "Therefore it is necessary to enable Linux Binary Compatibility in the host " "system." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1216 msgid "To enable the Linux ABI at boot time, execute the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1220 #, no-wrap msgid "# sysrc linux_enable=\"YES\"\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1223 msgid "" "Once enabled, it can be started without rebooting by executing the following " "command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1227 #, no-wrap msgid "# service linux start\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1231 msgid "" "The next step is to create a jail as indicated above, for example as in " "crossref:jails[creating-thin-jail-openzfs-snapshots, Creating a Thin Jail " "Using OpenZFS Snapshots], but *without* performing the configuration. " "FreeBSD Linux jails require a specific configuration that is detailed below." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1233 msgid "" "If the host does not already have an [.filename]#/etc/jail.conf# — for " "example on a system whose jails so far have been created only from the " "command line — create an empty one so that man:service[8] can stop the jail " "later:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1237 #, no-wrap msgid "# touch /etc/jail.conf\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1241 msgid "" "The man:service[8] jail script reads [.filename]#/etc/jail.conf# when " "stopping a jail, so the stop command fails if the file does not exist. If " "an [.filename]#/etc/jail.conf# is already present from an earlier section, " "this step is not needed." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1244 msgid "" "The following man:jail[8] command performs the required configuration for " "the jail and starts it directly, without a [.filename]#/etc/jail.conf# " "entry. The `-c` flag creates a new jail and `-m` modifies an existing one; " "combined as `-cm`, man:jail[8] creates the jail if it does not yet exist and " "updates it if it does:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1265 #, no-wrap msgid "" "# jail -cm \\\n" " name=ubuntu \\\n" " host.hostname=\"ubuntu.example.com\" \\\n" " path=\"/usr/local/jails/containers/ubuntu\" \\\n" " interface=\"em0\" \\\n" " ip4.addr=\"192.168.1.155\" \\\n" " exec.start=\"/bin/sh /etc/rc\" \\\n" " exec.stop=\"/bin/sh /etc/rc.shutdown\" \\\n" " mount.devfs \\\n" " devfs_ruleset=4 \\\n" " allow.mount \\\n" " allow.mount.devfs \\\n" " allow.mount.fdescfs \\\n" " allow.mount.procfs \\\n" " allow.mount.linprocfs \\\n" " allow.mount.linsysfs \\\n" " allow.mount.tmpfs \\\n" " enforce_statfs=1\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1268 msgid "Access the newly created jail as `root` with man:jexec[8]:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1272 #, no-wrap msgid "# jexec -u root ubuntu sh\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1277 msgid "" "Inside the jail, install package:sysutils/debootstrap[] and use it to build " "the Ubuntu userland under [.filename]#/compat/ubuntu#. package:sysutils/" "debootstrap[] is the tool that builds the Linux userland; it is not required " "to enter the jail afterward. Running man:pkg[7] for the first time " "bootstraps it automatically:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1282 #, no-wrap msgid "" "# pkg install debootstrap\n" "# debootstrap jammy /compat/ubuntu\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1286 msgid "" "`jammy` selects Ubuntu 22.04 LTS. A newer LTS such as `noble` (Ubuntu " "24.04) can be selected instead, provided it runs under the linuxulator." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1289 msgid "" "When the process has finished and the message `Base system installed " "successfully` is displayed on the console, stop the jail from the host " "system. Because this jail is not enabled in [.filename]#/etc/rc.conf# and " "not yet listed in [.filename]#/etc/jail.conf#, use the `one`-prefixed " "man:service[8] action, which runs even for a jail that is not enabled:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1293 #, no-wrap msgid "# service jail onestop ubuntu\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1296 msgid "" "The `onestart` and `onestop` actions are the counterparts of `start` and " "`stop` for jails that are not enabled through `jail_enable` or listed in " "`jail_list`." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1298 msgid "Then add an entry in [.filename]#/etc/jail.conf# for the Linux jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1306 #, no-wrap msgid "" "ubuntu {\n" " # STARTUP/LOGGING\n" " exec.start = \"/bin/sh /etc/rc\";\n" " exec.stop = \"/bin/sh /etc/rc.shutdown\";\n" " exec.consolelog = \"/var/log/jail_console_${name}.log\";\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1312 #, no-wrap msgid "" " # PERMISSIONS\n" " allow.raw_sockets;\n" " exec.clean;\n" " mount.devfs;\n" " devfs_ruleset = 4;\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1320 #, no-wrap msgid "" " # NETWORK\n" " ip4.addr = 192.168.1.155;\n" " interface = em0;\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1330 #, no-wrap msgid "" " # MOUNT\n" " mount += \"devfs $path/compat/ubuntu/dev devfs rw 0 0\";\n" " mount += \"tmpfs $path/compat/ubuntu/dev/shm tmpfs rw,size=1g,mode=1777 0 0\";\n" " mount += \"fdescfs $path/compat/ubuntu/dev/fd fdescfs rw,linrdlnk 0 0\";\n" " mount += \"linprocfs $path/compat/ubuntu/proc linprocfs rw 0 0\";\n" " mount += \"linsysfs $path/compat/ubuntu/sys linsysfs rw 0 0\";\n" " mount += \"/tmp $path/compat/ubuntu/tmp nullfs rw 0 0\";\n" " mount += \"/home $path/compat/ubuntu/home nullfs rw 0 0\";\n" "}\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1337 msgid "" "The jail can also present a specific Linux kernel identity to the programs " "running inside it. The `linux` parameter selects whether the jail inherits " "the host's Linux emulation environment (`inherit`) or gets its own (`new`), " "and `linux.osname`, `linux.osrelease`, and `linux.oss_version` set the OS " "name, release, and OSS version that Linux binaries see. For example, " "`linux.osrelease=6.1.0` makes man:uname[1] and version-checking Linux " "programs inside the jail report that kernel release instead of the host-wide " "`compat.linux.osrelease` value." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1340 msgid "Then the jail can be started as usual with the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1344 #, no-wrap msgid "# service jail start ubuntu\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1347 msgid "The Ubuntu environment can be accessed using the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1351 #, no-wrap msgid "# jexec ubuntu chroot /compat/ubuntu /bin/bash\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1354 msgid "" "More information can be found in the chapter " "crossref:linuxemu[linuxemu,Linux Binary Compatibility]." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:1356 #, no-wrap msgid "NAT and Port Forwarding for Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1360 msgid "" "A jail that is given a private address — on a cloned man:lo[4] interface " "such as `lo1`, on a private bridge, or on a VNET epair on an internal " "network — has no route to the internet of its own. The host must translate " "the jail's traffic to a routable address, and, to reach a service running " "inside such a jail from outside, redirect incoming connections to the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1363 msgid "" "First, allow the host to forward packets between its interfaces. Enable it " "at boot and immediately with the following commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1368 #, no-wrap msgid "" "# sysrc gateway_enable=\"YES\"\n" "# sysctl net.inet.ip.forwarding=1\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1371 msgid "" "For IPv6, use `ipv6_gateway_enable=\"YES\"` and `net.inet6.ip6.forwarding=1`." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1374 msgid "" "Then configure Network Address Translation on the host with man:pf[4]. The " "following [.filename]#/etc/pf.conf# gives every jail on the private " "`192.168.0.0/24` network outbound access through the host's external " "interface `em0`, and publishes a jailed web server on the host's port 80:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1378 #, no-wrap msgid "ext_if = \"em0\"\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1381 #, no-wrap msgid "" "# Translate outbound jail traffic to the host address\n" "nat on $ext_if from 192.168.0.0/24 to any -> ($ext_if)\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1384 #, no-wrap msgid "" "# Forward inbound web traffic to the jailed server\n" "rdr on $ext_if proto tcp to port 80 -> 192.168.0.151\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1387 msgid "The `rdr` target must be the jail's own address." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1389 msgid "Enable and start man:pf[4] with the following commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1394 #, no-wrap msgid "" "# sysrc pf_enable=\"YES\"\n" "# service pf start\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1400 msgid "" "FreeBSD 15.0 adds the OpenBSD-style inline `nat-to` and `rdr-to` syntax, " "which attaches translation to a `pass` or `match` rule, for example `match " "out on $ext_if from 192.168.0.0/24 to any nat-to ($ext_if)`. The classic " "`nat on` and `rdr on` rules shown above work on both FreeBSD 14.x and 15.x." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1403 msgid "" "For the full treatment of man:pf[4] and man:ipfw[8], including complete rule " "sets and man:ipfw[8]-based NAT, see crossref:firewalls[firewalls,Firewalls]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1413 msgid "" "Service jails are available since FreeBSD 15.0. A service jail is " "configured completely via [.filename]#/etc/rc.conf# or man:sysrc[8]. The " "base system services are service jails ready. They contain a config line " "which enables networking or lifts other restrictions of jails. Base system " "services which do not make sense to run inside jails are configured to not " "be started as a service jail, even if enabled in [.filename]#/etc/rc.conf#. " "Some examples of such a service are services which want to mount or unmount " "something in the start or stop method, or only configure something like a " "route, or firewall, or the like." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1416 msgid "" "Third party services may or may not be service jails ready. To check if a " "service is service jail ready, the following command can be used:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1420 #, no-wrap msgid "# grep _svcj_options /path/to/rc.d/servicename\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1423 msgid "" "If there is no output, the service is not service jail ready, or does not " "need any additional privileges like for example, network access." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1425 msgid "" "If the service is not service jail ready, and needs network access, it can " "be made ready by adding the necessary config to [.filename]#/etc/rc.conf#:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1429 #, no-wrap msgid "# sysrc servicename_svcj_options=net_basic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1432 msgid "For all possible `_svcj_options` see the man:rc.conf[5] man-page." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1435 msgid "" "To enable a service jail for a given service, the service needs to be " "stopped and the `servicename_svcj` variable needs to be set to YES. To put " "man:syslogd[8] into a service jail, use the following sequence of commands:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1441 #, no-wrap msgid "" "# service syslogd stop\n" "# sysrc syslogd_svcj=YES\n" "# service syslogd start\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1445 msgid "" "If the `servicename_svcj` variable is changed, the service needs to be " "stopped before it is changed. If it is not stopped, the rc framework will " "not detect the correct state of the service and will not be able to do what " "is requested." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1448 msgid "" "Service jails are managed only via man:rc.conf[5]/man:sysrc[8] and the " "man:service[8] command. The jail utilities, like man:jls[8] as described in " "crossref:jails[jail-management,Jail Management], can be used to investigate " "the operation, but the man:jail[8] command is not supposed to be used to " "manage them." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:1450 #, no-wrap msgid "Jail Management" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1454 msgid "" "Once the jail is created, there are a number of operations that can be " "performed, like starting, rebooting or deleting the jail, installing " "software in it, etc. In this section the different actions that can be done " "with jails from the host will be described." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1456 #, no-wrap msgid "List Running Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1459 msgid "" "To list the jails that are running on the host system, the command " "man:jls[8] can be used:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1463 #, no-wrap msgid "# jls\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1470 #, no-wrap msgid "" " JID IP Address Hostname Path\n" " 1 192.168.1.151 classic /usr/local/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1473 msgid "" "man:jls[8] supports the `--libxo` argument, which through the man:libxo[3] " "library allows other types of formats to be displayed, such as `JSON`, " "`HTML`, etc." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1475 msgid "For example, execute the following command to get the `JSON` output:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1479 #, no-wrap msgid "# jls --libxo=json\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1485 #, no-wrap msgid "{\"__version\": \"2\", \"jail-information\": {\"jail\": [{\"jid\":1,\"ipv4\":\"192.168.1.151\",\"hostname\":\"classic\",\"path\":\"/usr/local/jails/containers/classic\"}]}}\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1489 msgid "" "The default listing is only a small part of what man:jls[8] can report. Add " "the `-v` flag for a verbose, multi-line summary of each jail that includes " "its state and its assigned cpuset ID:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1493 #, no-wrap msgid "# jls -v\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1496 msgid "" "Use `-h` to print a header line with the field names above the values of the " "requested parameters:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1500 #, no-wrap msgid "# jls -h jid name path\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1503 msgid "" "To query specific parameters of a single jail, name it with `-j` and list " "the parameters to print:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1507 #, no-wrap msgid "# jls -j classic path host.hostname ip4.addr\n" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1513 #, no-wrap msgid "/usr/local/jails/containers/classic classic 192.168.1.151\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1516 msgid "" "Add `-d` to include jails that are shutting down, which are otherwise hidden " "while in the dying state:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1520 #, no-wrap msgid "# jls -d\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1523 #, no-wrap msgid "Start, Restart, and Stop a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1526 msgid "man:service[8] is used to start, reboot, or stop a jail on the host." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1528 msgid "For example, to start a jail, run the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1532 #, no-wrap msgid "# service jail start jailname\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1535 msgid "" "Change the `start` argument to `restart` or `stop` to perform other actions " "on the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1542 msgid "" "Stopping a jail is more than killing the processes inside it. When a jail " "is stopped, man:jail[8] first runs the commands in its `exec.stop` parameter " "— typically `/bin/sh /etc/rc.shutdown` — inside the jail so that its " "services shut down cleanly. It then sends `SIGTERM` to any processes still " "running in the jail and waits up to `stop.timeout` seconds (10 by default) " "for them to exit. Once that time has passed, the jail is removed, which " "kills whatever remains with `SIGKILL`. If `stop.timeout` is set to zero, no " "`SIGTERM` is sent and the jail is removed immediately. This is why a jail " "with a slow-stopping daemon can appear to hang for ten seconds while it " "stops; raise `stop.timeout` in [.filename]#/etc/jail.conf# for a jail that " "runs a database or another service that needs longer to shut down gracefully." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1544 #, no-wrap msgid "Destroy a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1547 msgid "" "Destroying a jail is not as simple as stopping the jail using man:service[8] " "and removing the jail directory and [.filename]#/etc/jail.conf# entry." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1552 msgid "" "FreeBSD takes system security very seriously. For this reason there are " "certain files that not even the root user can delete. This functionality is " "known as File Flags. On a jail whose files live on a UFS file system, these " "flags must be cleared before the jail directory can be removed." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1554 msgid "" "The first step is to stop the desired jail executing the following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1558 #, no-wrap msgid "# service jail stop classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1561 msgid "" "The second step is to remove these flags with man:chflags[1] by executing " "the following command, in which `classic` is the name of the jail to remove:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1565 #, no-wrap msgid "# chflags -R 0 /usr/local/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1568 msgid "The third step is to delete the directory where the jail was:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1572 #, no-wrap msgid "# rm -rf /usr/local/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1577 msgid "" "The two steps above apply to a jail stored on a UFS file system. A jail " "backed by its own ZFS dataset — as created in crossref:jails[host-" "configuration-directories,Setting Up the Jail Directory Tree] — is removed " "by destroying the dataset instead. Dataset destruction is not blocked by " "file flags, so the man:chflags[1] step is unnecessary in this case:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1582 #, no-wrap msgid "" "# service jail stop classic\n" "# zfs destroy zroot/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1585 msgid "Add `-r` to also destroy any snapshots the dataset holds." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1591 msgid "" "A ZFS thin jail created by cloning a template snapshot (see " "crossref:jails[thin-jail,Thin Jails]) depends on that snapshot. While any " "clone still exists, man:zfs[8] refuses to destroy the template snapshot and " "prints the list of dependent clones. To retire a template, first destroy " "every jail cloned from it, or run `zfs promote` on a clone so it no longer " "depends on the template." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1595 msgid "" "Finally, in either case, remove the jail entry in [.filename]#/etc/" "jail.conf# or in [.filename]#/etc/jail.conf.d#. For a NullFS thin jail, " "also delete its [.filename]#.fstab# file and its now-empty mountpoint " "directory." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1597 #, no-wrap msgid "Handle Packages in a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1600 msgid "" "The man:pkg[8] tool supports the `-j` argument in order to handle packages " "installed inside the jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1602 msgid "" "For example, to install package:www/nginx-lite[] in the jail, the next " "command can be executed *from the host*:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1606 #, no-wrap msgid "# pkg -j classic install nginx-lite\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1609 msgid "" "For more information on working with packages in FreeBSD, see " "crossref:ports[ports,\"Installing Applications: Packages and Ports\"]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1611 #, no-wrap msgid "Managing Services in a Jail from the Host" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1615 msgid "" "Services inside a jail can be enabled and controlled from the host without " "first entering the jail with man:jexec[8]. Both man:service[8] and " "man:sysrc[8] accept a `-j` argument that names the target jail by ID or name " "and operates on that jail's man:rc[8] configuration." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1617 msgid "" "Continuing the package example above, enable and start nginx in the " "`classic` jail directly from the host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1622 #, no-wrap msgid "" "# sysrc -j classic nginx_enable=YES\n" "# service -j classic nginx start\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1625 msgid "" "These commands have the same effect as running man:sysrc[8] and " "man:service[8] through man:jexec[8], but they keep host-side administration " "and scripting uniform with an unjailed system." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1627 #, no-wrap msgid "Access a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1630 msgid "" "While it has been stated above that it is best to manage jails from the host " "system, a jail can be entered with man:jexec[8]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1632 msgid "The jail can be entered by running man:jexec[8] from the host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1636 #, no-wrap msgid "# jexec -u root jailname\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1642 msgid "" "The `-u` flag selects the user to run as, resolving the name against the " "*host* password database. To resolve the user against the *jail's* own " "password database instead, use `-U`. When no command is given, as here, " "man:jexec[8] starts that user's login shell inside the jail. Add `-l` to " "run it in a clean login environment that keeps only `HOME`, `SHELL`, `TERM`, " "and `USER`, resets `PATH` to [.filename]#/bin:/usr/bin#, and behaves like a " "fresh login; `-d` sets the working directory, which defaults to the jail " "root." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1644 msgid "" "When gaining access to the jail, the message configured in man:motd[5] will " "be displayed." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1646 #, no-wrap msgid "Execute Commands in a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1649 msgid "" "To execute a command from the host system in a jail the man:jexec[8] can be " "used." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1651 msgid "" "For example, to stop a service that is running inside a jail, the command " "will be executed:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1655 #, no-wrap msgid "# jexec -l jailname service nginx stop\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1658 #, no-wrap msgid "Viewing Jailed Processes and Sockets from the Host" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1661 msgid "" "From the host, the processes and sockets of every jail are visible and can " "be filtered by jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1663 msgid "" "man:ps[1] accepts `-J` to restrict its output to a single jail, given by JID " "or name:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1667 #, no-wrap msgid "# ps -J classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1670 msgid "" "The output should be similar to the following, where the `J` in the `STAT` " "column marks a process that is running in a jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1675 #, no-wrap msgid "" " PID TT STAT TIME COMMAND\n" "2841 - IsJ 0:00.02 /usr/sbin/syslogd -ss\n" "2903 - IsJ 0:00.00 nginx: master process /usr/local/sbin/nginx\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1680 msgid "" "Use `ps -J 0` to show only the host's own processes. The `jail` and `jid` " "keywords can also be added to the `-o` output format to show which jail each " "process belongs to. For example, to list every process on the host together " "with its jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1684 #, no-wrap msgid "# ps ax -o pid,jail,command\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1687 msgid "" "man:top[1] takes `-J` to filter its live display to one jail, which implies " "`-j` and adds the `JID` column:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1691 #, no-wrap msgid "# top -J classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1694 msgid "" "man:sockstat[1] lists the sockets belonging to a jail with `-j`, which is " "the natural way to check which ports a jail's daemons have actually bound " "after starting a service in it:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1698 #, no-wrap msgid "# sockstat -4 -6 -l -j classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1701 msgid "" "From inside a jail the picture is reversed: a jailed process sees only its " "own jail's processes and sockets, never those of the host or of other jails." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1703 #, no-wrap msgid "Managing Jails Directly with the jail Utility" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1706 msgid "" "The man:service[8] wrapper shown above is the usual way to run jails at " "boot, but man:jail[8] can also create, modify, and remove jails directly, " "which is useful for scripting and for testing a configuration without the rc " "framework." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1708 msgid "Create a configured jail by name:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1712 #, no-wrap msgid "# jail -c classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1715 msgid "" "Remove a running jail; this also removes any child jails it created and " "kills the processes inside it:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1719 #, no-wrap msgid "# jail -r classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1723 msgid "" "The `-m` flag modifies the parameters of an already-running jail without " "restarting it. For example, to add a second IPv4 address to a running jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1727 #, no-wrap msgid "# jail -m name=classic ip4.addr+=192.168.250.71\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1730 msgid "" "man:jail[8] notes that \"Some parameters may not be changed on a running " "jail\"; in practice this includes `path` and `vnet`, which require the jail " "to be restarted." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1733 msgid "" "Finally, `-e` exhibits all configured non-wildcard jails and their " "parameters without creating, modifying, or removing anything, which is handy " "for verifying a configuration file. It takes a string used to separate the " "parameters:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1737 #, no-wrap msgid "# jail -e ,\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1740 #, no-wrap msgid "Backing Up and Migrating a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1743 msgid "" "A jail is largely self-contained, so backing one up or moving it to another " "host is mostly a matter of copying its files and its configuration." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1746 msgid "" "Stop the jail first for a consistent copy; a ZFS-backed jail can instead be " "snapshotted while running. For a jail on its own ZFS dataset, take a " "recursive snapshot and stream it to the destination host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1752 #, no-wrap msgid "" "# service jail stop classic\n" "# zfs snapshot -r zroot/jails/containers/classic@migrate\n" "# zfs send -R zroot/jails/containers/classic@migrate | ssh newhost zfs receive zroot/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1755 msgid "" "The full mechanics of man:zfs-send[8] and man:zfs-receive[8], including " "incremental transfers, are covered in crossref:zfs[zfs-zfs-send,Replication]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1757 msgid "" "For a jail on a UFS file system, use man:tar[1] with `-p` so that ownership, " "permissions, and file flags are preserved:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1761 #, no-wrap msgid "# tar -cpf classic.tar -C /usr/local/jails/containers classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1765 msgid "" "Extract the archive as `root` on the destination host with `tar -xpf` so the " "flags survive. man:dump[8] and man:restore[8] are an alternative when a " "jail occupies a dedicated UFS file system of its own; they operate on whole " "file systems, so they do not apply to the layout used in this chapter, where " "all jails are directories within one shared file system." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1767 msgid "" "Finally, copy the jail's block from [.filename]#/etc/jail.conf# — or its " "file in [.filename]#/etc/jail.conf.d# — to the new host, adjust any host-" "specific parameters such as `interface`, `ip4.addr`, or the bridge used by a " "VNET jail, and start the jail there." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1773 msgid "" "The destination host must not run an older FreeBSD release than the jail's " "userland, following the same rule that a jail can never run a newer version " "than its host. A NullFS thin jail is not self-contained: its template and " "skeleton must exist on the destination host too, so migrate those as well or " "convert the jail to a thick copy first. Any man:rctl[8] rules kept in " "[.filename]#/etc/rctl.conf# must be carried over separately." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:1776 #, no-wrap msgid "Administration from Inside a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1780 msgid "" "Most jail administration is done from the host, but some tasks are performed " "from within the jail itself, and a script running inside a jail sometimes " "needs to know that it is jailed. This section describes what an " "administrator sees and can do from inside a jail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1782 msgid "" "A process can detect whether it is running inside a jail by reading the " "`security.jail.jailed` sysctl, which is `1` inside a jail and `0` on the " "host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1787 #, no-wrap msgid "" "# sysctl security.jail.jailed\n" "security.jail.jailed: 1\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1790 msgid "Inside a jail the environment is deliberately restricted:" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1793 msgid "" "The host's view of the system is hidden. A jailed process sees only its own " "jail's processes, sockets, and file systems, never those of the host or of " "other jails." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1795 msgid "" "Kernel state is largely read-only. Kernel tunables cannot be written from " "inside a jail, man:kldload[8] and man:kldunload[8] are not permitted, and " "man:dmesg[8] and the kernel message buffer are unavailable unless " "`allow.read_msgbuf` is set." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1797 msgid "" "Privileged operations that would cross the jail boundary are denied unless " "the host explicitly allows them. Creating raw sockets — as man:ping[8] and " "man:traceroute[8] require — needs `allow.raw_sockets` (see the parameter " "description in crossref:jails[jail-configuration-files,Jail Configuration " "Files]), mounting file systems needs `allow.mount` and its per-filesystem " "children, and man:chflags[1] is disabled by default (see crossref:jails[jail-" "upgrading,Jail Upgrading])." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1800 msgid "" "A handful of per-jail sysctl variables can be changed from inside the jail " "without affecting the host, including `kern.hostname`, `kern.domainname`, " "`kern.hostid`, `kern.hostuuid`, `kern.securelevel`, and " "`security.bsd.suser_enabled`. The current set of available jail parameters " "can be listed with man:sysctl[8]:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1804 #, no-wrap msgid "# sysctl -d security.jail.param\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1808 msgid "" "Managing the jail's own services from inside works exactly as it does on an " "unjailed system: man:service[8] and man:sysrc[8] operate on the jail's own " "man:rc[8] configuration. This is the in-jail counterpart to the host-side " "crossref:jails[jail-services-host,service -j and sysrc -j] shown above." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:1810 #, no-wrap msgid "Jail Upgrading" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1813 msgid "" "Upgrading FreeBSD Jails ensures that the isolated environments remain " "secure, up-to-date, and in line with the latest features and improvements " "available in the FreeBSD ecosystem." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1819 msgid "" "The right tool depends on how the jail's userland was installed. Jails " "installed from a distribution set (the [.filename]#base.txz# extracted in " "the creation sections, or one produced by man:bsdinstall[8]) are updated " "from the host with man:freebsd-update[8] through its `-j` flag, on both " "FreeBSD 14.x and 15.x. Jails installed from base packages, available from " "FreeBSD 15.0, are updated with man:pkg[8] instead; man:freebsd-update[8] " "does not apply to them. Jails built from source are updated with the source " "procedure (`make installworld` and `make distribution`). Never mix these " "mechanisms on the same jail." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1824 msgid "" "Support for distribution sets is planned for removal in FreeBSD 16, but will " "continue, together with man:freebsd-update[8], for the lifetime of the " "FreeBSD 15 stable branch. Base packages are offered as a technology preview " "in FreeBSD 15.0 and are expected to become the standard method in future " "releases, so pkgbase is the forward-looking path." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1829 msgid "" "On OpenZFS, snapshot the jail's dataset before upgrading, so a failed " "upgrade can be undone instantly:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1833 #, no-wrap msgid "# zfs snapshot zroot/jails/containers/classic@preupgrade\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1839 msgid "" "If the upgrade fails, stop the jail and run `zfs rollback zroot/jails/" "containers/classic@preupgrade` to restore the previous state. This requires " "the jail to be its own dataset: the OpenZFS thin-jail clone already is, but " "a classic jail created with man:mkdir[1] is not, so create it with `zfs " "create` instead. For a NullFS thin jail, snapshot the template dataset " "instead. man:zfs-rollback[8] reverts only to the most recent snapshot " "unless `-r` is given to destroy any newer ones." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1842 #, no-wrap msgid "Upgrading a Classic Jail or a Thin Jail using OpenZFS Snapshots" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1847 msgid "" "Jails *must be updated from the host* operating system. The default " "behavior in FreeBSD is to disallow the use of man:chflags[1] in a jail. " "This will prevent the update of some files so updating from within the jail " "will fail." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1849 msgid "" "To update the jail to the latest patch release of the version of FreeBSD it " "is running, execute the following commands on the host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1854 #, no-wrap msgid "" "# freebsd-update -j classic fetch install\n" "# service jail restart classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1858 msgid "" "To upgrade the jail to a new major or minor version, first upgrade the host " "system as described in crossref:cutting-edge[freebsdupdate-upgrade," "\"Performing Major and Minor Version Upgrades\"]. Once the host has been " "upgraded and rebooted, the jail can then be upgraded." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1862 msgid "" "In case of upgrade from one version to another, it is easier to create a new " "jail than to upgrade completely." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1865 msgid "" "For example, to upgrade the `classic` jail to {rel-latest}-RELEASE, execute " "the following commands on the host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1873 #, no-wrap msgid "" "# freebsd-update -j classic -r {rel-latest}-RELEASE upgrade\n" "# freebsd-update -j classic install\n" "# service jail restart classic\n" "# freebsd-update -j classic install\n" "# service jail restart classic\n" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1880 msgid "" "The `install` step is run twice on purpose. A jail has no kernel of its own " "(it runs the host's kernel), so nothing here upgrades a kernel. The first " "`install` writes the new userland into the jail; after the jail restarts on " "the updated files, the second `install` finishes replacing the components " "that could not be changed while their previous versions were still in use." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1884 msgid "" "Then, if it was a major version upgrade, reinstall all installed packages " "and restart the jail again. This is required because the ABI version " "changes when upgrading between major versions of FreeBSD." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1886 msgid "From the host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1891 #, no-wrap msgid "" "# pkg -j classic upgrade -f\n" "# service jail restart classic\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1894 #, no-wrap msgid "Upgrading OpenZFS Thin Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1899 msgid "" "The thin jails created in crossref:jails[creating-thin-jail-openzfs-" "snapshots,\"Creating a Thin Jail Using OpenZFS Snapshots\"] are OpenZFS " "clones of a template snapshot, but a clone is independent of that template " "once it exists. Refreshing the template does *not* update jails that were " "already cloned from it, and updating a clone does *not* update the " "template. There are therefore two ways to keep these jails current." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1902 msgid "" "The first option is to update each clone in place with man:freebsd-" "update[8], exactly as for a classic jail, as described in " "crossref:jails[jails-updating,\"Upgrading a Classic Jail or a Thin Jail " "using OpenZFS Snapshots\"]. This is the simplest approach for a handful of " "jails, but every clone that is patched diverges from the template snapshot: " "the changed blocks are duplicated per jail, which erodes the space savings, " "and a major upgrade rewrites so much of the userland that most of the " "sharing is lost." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1905 msgid "" "The second option keeps the sharing intact by refreshing the template and re-" "cloning. Update the template to the latest patch level on the host:" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1915 msgid "" "man:freebsd-update[8] with `-b` reads the running release from the host's " "`uname -r`, not from the template. If the template runs an older release " "than the host, add `--currently-running ` so it patches " "the template's release instead of the host's, as shown in " "crossref:jails[upgrading-thin-jail,\"Upgrading a Thin Jail Using NullFS\"]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1918 msgid "Then take a new snapshot and clone future jails from it:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1923 #, no-wrap msgid "" "# zfs snapshot zroot/jails/templates/{rel-latest}-RELEASE@base-p2\n" "# zfs clone zroot/jails/templates/{rel-latest}-RELEASE@base-p2 zroot/jails/containers/newjail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1927 msgid "" "Existing clones keep the base they were created from until they are re-" "created from the new snapshot. For a major or minor version upgrade, create " "a fresh template dataset for the new release following " "crossref:jails[creating-thin-jail-openzfs-snapshots,\"Creating a Thin Jail " "Using OpenZFS Snapshots\"], rather than upgrading the existing template in " "place, and clone new jails from its `@base` snapshot." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1931 msgid "" "Keep each jail's application data and configuration on separate datasets, or " "in the jail's local storage, so that re-creating a jail from an updated " "template snapshot is cheap and preferable to patching every clone " "individually." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1934 #, no-wrap msgid "Upgrading a Thin Jail Using NullFS" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1939 msgid "" "Since Thin Jails that use NullFS share the majority of system directories, " "they are very easy to update. It is enough to update the template. This " "allows updating multiple jails at the same time." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1941 msgid "" "To update the template to the latest patch release of the version of FreeBSD " "it is running, execute the following commands on the host:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1946 #, no-wrap msgid "" "# freebsd-update -b /usr/local/jails/templates/{rel-latest}-RELEASE-base/ fetch install\n" "# service jail restart\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1950 msgid "" "To upgrade the template to a new major or minor version, first upgrade the " "host system as described in crossref:cutting-edge[freebsdupdate-upgrade," "\"Performing Major and Minor Version Upgrades\"]. Once the host has been " "upgraded and rebooted, the template can then be upgraded." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1954 msgid "" "Because the host was upgraded first, man:freebsd-update[8] with `-b` would " "otherwise detect the host's new release rather than the template's older " "one: `-b` reads the running version from the host's `uname -r`, unlike `-j`, " "which detects the jail's own userland. Pass `--currently-running ` so the template is patched from its actual release. The following " "example upgrades a template running 14.2-RELEASE to 14.3-RELEASE; substitute " "the releases that apply:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1962 #, no-wrap msgid "" "# freebsd-update -b /usr/local/jails/templates/14.2-RELEASE-base/ --currently-running 14.2-RELEASE -r 14.3-RELEASE upgrade\n" "# freebsd-update -b /usr/local/jails/templates/14.2-RELEASE-base/ install\n" "# service jail restart\n" "# freebsd-update -b /usr/local/jails/templates/14.2-RELEASE-base/ install\n" "# service jail restart\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:1965 #, no-wrap msgid "Upgrading pkgbase Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1968 msgid "" "Jails installed from base packages, available from FreeBSD 15.0, are " "upgraded with man:pkg[8] against the `FreeBSD-base` repository rather than " "with man:freebsd-update[8]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1970 msgid "" "The `FreeBSD-base` repository is defined in [.filename]#/etc/pkg/" "FreeBSD.conf# but is disabled by default on FreeBSD 15.0, so enable it " "before upgrading." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1972 msgid "" "From the host, point man:pkg[8] at the jail's root directory with `-r` (`--" "rootdir`):" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1978 #, no-wrap msgid "" "# pkg -r /usr/local/jails/containers/pkgjail update\n" "# pkg -r /usr/local/jails/containers/pkgjail upgrade\n" "# service jail restart pkgjail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1981 msgid "" "The same upgrade can be run from inside the jail with man:jexec[8] and a " "plain `pkg upgrade`:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:1986 #, no-wrap msgid "" "# jexec -l pkgjail pkg upgrade\n" "# service jail restart pkgjail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1993 msgid "" "man:pkg[8] performs a three-way merge on tagged configuration files under " "[.filename]#/etc#. When a merge cannot be completed automatically it leaves " "the new version as [.filename]#.pkgnew#, and when it takes over a file " "that was not previously packaged it saves the old copy as " "[.filename]#.pkgsave#. Review [.filename]#/etc# after an upgrade and " "reconcile any such files by hand. Do not run man:etcupdate[8] on a pkgbase " "system; man:pkg[8] handles configuration merging itself. See " "crossref:cutting-edge[cutting-edge,\"Updating and Upgrading FreeBSD\"] for " "the host-side base-package workflow." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:1995 #, no-wrap msgid "Jail Resource Limits" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:1998 msgid "" "Controlling the resources that a jail uses from the host system is a task to " "be taken into account by the system administrator." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2000 msgid "" "Use man:rctl[8] to manage the resources that a jail can use from the host " "system." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2004 msgid "" "The `kern.racct.enable` tunable must be enabled at [.filename]#/boot/" "loader.conf#." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2007 msgid "The syntax to limit the resources of a jail is as follows:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2011 #, no-wrap msgid "rctl -a jail::resource:action=amount[/per]\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2016 msgid "" "The optional `per` component is not a percentage; it is the accounting " "entity the limit is applied to, one of `process`, `user`, `loginclass`, or " "`jail`. For example, `deny=2G/jail` limits the sum for the whole jail, " "while `deny=2G/process` applies the same figure to each process " "individually. A percentage is only meaningful for the `pcpu` resource, " "whose amount is expressed as a percentage of a single CPU core." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2018 msgid "" "For example, to limit the maximum RAM that a jail can access, run the " "following command:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2022 #, no-wrap msgid "# rctl -a jail:classic:memoryuse:deny=2G\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2025 msgid "" "To make the limitation persistent across reboots of the host system, it will " "be necessary to add the rule to the [.filename]#/etc/rctl.conf# file as " "follows:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2029 #, no-wrap msgid "jail:classic:memoryuse:deny=2G/jail\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2034 msgid "" "man:rctl[8] can limit far more than memory. The resources most relevant to " "a jail include `pcpu` (percentage of a single CPU core), `maxproc` (number " "of processes), `openfiles` (open file descriptors), `vmemoryuse` (address " "space), and `swapuse` (swap space). Each of them is set the same way:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2041 #, no-wrap msgid "" "# rctl -a jail:classic:pcpu:deny=80\n" "# rctl -a jail:classic:maxproc:deny=1000\n" "# rctl -a jail:classic:openfiles:deny=5000\n" "# rctl -a jail:classic:vmemoryuse:deny=4G\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2044 msgid "" "Disk throughput is limited with `readbps` and `writebps`, but these " "resources do not support the `deny` action; pair them with `throttle` " "instead:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2048 #, no-wrap msgid "# rctl -a jail:classic:writebps:throttle=1m\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2051 msgid "" "The action after the resource selects what happens when the limit is " "reached: `deny` blocks the operation, `log` records it to the system log, " "and `devctl` sends a notification through man:devd[8]." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2053 msgid "" "Report the current resource usage of a jail with the `-u` flag, adding `-h` " "for human-readable units:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2057 #, no-wrap msgid "# rctl -hu jail:classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2060 msgid "List the rules that apply to a jail:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2064 #, no-wrap msgid "# rctl jail:classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2067 msgid "Remove every rule that matches a jail with `-r`:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2071 #, no-wrap msgid "# rctl -r jail:classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2074 msgid "" "More information on resource limits can be found in the security chapter in " "the crossref:security[security-resourcelimits,\"Resource Limits section\"]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2076 #, no-wrap msgid "CPU Pinning with cpuset" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2079 msgid "" "man:rctl[8] with `pcpu` caps how much CPU time a jail may consume, but it " "does not tie the jail to particular cores; man:cpuset[1] assigns specific " "cores instead." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2081 msgid "Restrict a running jail to a set of CPUs by its name or JID:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2085 #, no-wrap msgid "# cpuset -l 0-3 -j classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2088 msgid "Query the cores a jail is currently allowed to use with `-g`:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2092 #, no-wrap msgid "# cpuset -g -j classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2096 msgid "" "The assigned set is also reported in the cpuset column of `jls -v`. There " "is no jail.conf parameter for CPU affinity, so pin the jail at start time by " "running man:cpuset[1] from an `exec.created` or `exec.poststart` hook, both " "of which run in the host environment:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2100 #, no-wrap msgid "exec.poststart = \"cpuset -l 0-3 -j classic\";\n" msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2103 #, no-wrap msgid "Limiting Disk Space" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2107 msgid "" "man:rctl[8] has no resource for filesystem space. When each jail lives in " "its own ZFS dataset, cap and guarantee its disk usage with ZFS quotas and " "reservations instead:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2112 #, no-wrap msgid "" "# zfs set quota=20G zroot/jails/containers/classic\n" "# zfs set reservation=5G zroot/jails/containers/classic\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2117 msgid "" "This requires the jail to be a dataset of its own. The ZFS thin jails " "created earlier already are, but the Classic Jail procedure creates the jail " "directory with `mkdir` inside the shared [.filename]#containers# dataset, so " "create it with `zfs create` first for these commands to apply. See " "crossref:jails[host-configuration-directories,\"Setting Up the Jail " "Directory Tree\"] for the dataset layout and man:zfs-set[8] for the `quota` " "and `reservation` properties." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:2119 #, no-wrap msgid "More Jail Options" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2126 msgid "" "man:jail[8] exposes many more parameters than the examples in this chapter " "use. A jail is a strong isolation boundary, but it is not an absolute one. " "Every `allow.*` relaxation trades isolation for capability and moves the " "jail's privileged users a step closer to the privileges of the host's " "`root`. Grant a jail only the permissions the workload inside it genuinely " "needs, and leave everything else at its more restrictive default. The full " "list is in man:jail[8] and man:jail.conf[5]; the parameters below are the " "ones an administrator reaches for most often." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2128 #, no-wrap msgid "The allow.* Permissions" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2132 msgid "" "The `allow.*` parameters are booleans that hand individual privileges to the " "jail. Per man:jail[8], \"With the exception of allow.set_hostname and " "allow.reserved_ports, these boolean parameters are off by default\", so a " "jail starts locked down and each capability must be granted explicitly." msgstr "" #. type: Block title #: documentation/content/en/books/handbook/jails/_index.adoc:2133 #, no-wrap msgid "Common `allow.*` parameters" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2136 #, no-wrap msgid "Parameter" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2136 #, no-wrap msgid "Default" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2138 #, no-wrap msgid "Effect" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2139 #, no-wrap msgid "`allow.set_hostname`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2140 #: documentation/content/en/books/handbook/jails/_index.adoc:2144 #, no-wrap msgid "On" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2142 #, no-wrap msgid "The jail may change its own hostname." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2143 #, no-wrap msgid "`allow.reserved_ports`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2146 #, no-wrap msgid "Jailed `root` may bind the reserved ports below 1024." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2147 #, no-wrap msgid "`allow.raw_sockets`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2148 #: documentation/content/en/books/handbook/jails/_index.adoc:2152 #: documentation/content/en/books/handbook/jails/_index.adoc:2156 #: documentation/content/en/books/handbook/jails/_index.adoc:2160 #: documentation/content/en/books/handbook/jails/_index.adoc:2164 #: documentation/content/en/books/handbook/jails/_index.adoc:2168 #: documentation/content/en/books/handbook/jails/_index.adoc:2172 #: documentation/content/en/books/handbook/jails/_index.adoc:2176 #: documentation/content/en/books/handbook/jails/_index.adoc:2180 #: documentation/content/en/books/handbook/jails/_index.adoc:2184 #, no-wrap msgid "Off" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2150 #, no-wrap msgid "Enables raw sockets, so man:ping[8] and man:traceroute[8] work inside the jail." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2151 #, no-wrap msgid "`allow.chflags`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2154 #, no-wrap msgid "Jailed `root` may manipulate system file flags as it would on the host." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2155 #, no-wrap msgid "`allow.mount`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2158 #, no-wrap msgid "The jail may mount and unmount filesystems, together with the `allow.mount.*` children." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2159 #, no-wrap msgid "`allow.quotas`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2162 #, no-wrap msgid "The jail may administer filesystem quotas." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2163 #, no-wrap msgid "`allow.read_msgbuf`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2166 #, no-wrap msgid "Jailed processes may read the kernel message buffer with man:dmesg[8]." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2167 #, no-wrap msgid "`allow.socket_af`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2170 #, no-wrap msgid "Allows socket address families other than IPv4, IPv6, local, and route." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2171 #, no-wrap msgid "`allow.mlock`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2174 #, no-wrap msgid "Jailed processes may lock physical memory with man:mlock[2]." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2175 #, no-wrap msgid "`allow.unprivileged_proc_debug`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2178 #, no-wrap msgid "Unprivileged users may use debugging facilities on their own processes." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2179 #, no-wrap msgid "`allow.vmm`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2182 #, no-wrap msgid "The jail may use the man:vmm[4] hypervisor to run man:bhyve[8] guests." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2183 #, no-wrap msgid "`allow.nfsd`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2185 #, no-wrap msgid "The jail may run an NFS server." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2188 msgid "" "Weigh each relaxation against what it exposes: `allow.raw_sockets` lets " "jailed processes forge packets, `allow.chflags` lets jailed `root` clear the " "immutable and append-only flags the host relies on, and `allow.mount` opens " "up the filesystem namespace." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2190 msgid "" "Running an NFS server inside a jail, highlighted in the FreeBSD 14.0 release " "notes, needs `allow.nfsd` set, a VNET jail whose root directory is itself a " "filesystem mount point, and `enforce_statfs` not set to `0`." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2192 #, no-wrap msgid "System V IPC" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2196 msgid "" "Databases and other software that rely on System V shared memory, " "semaphores, and message queues are controlled per module with the `sysvmsg`, " "`sysvsem`, and `sysvshm` parameters. Each takes one of three values: " "`inherit` makes all of the host's IPC objects visible to the jail, `new` " "gives the jail its own private key namespace, and `disable` makes the " "related system calls fail." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2198 msgid "" "For the classic case of running PostgreSQL in a jail, `new` is the right " "choice, giving the database its own shared-memory namespace without exposing " "the host's:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2204 #, no-wrap msgid "" "sysvmsg = new;\n" "sysvsem = new;\n" "sysvshm = new;\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2208 msgid "" "The older `allow.sysvipc` parameter is deprecated. It is equivalent to " "setting all three module parameters to `inherit`, which shares the host-wide " "IPC namespace with the jail, so prefer the per-module parameters above." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2210 #, no-wrap msgid "Mounting Filesystems" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2215 msgid "" "`allow.mount` lets a jail mount filesystems, and a family of child " "parameters selects which types: `allow.mount.devfs`, `allow.mount.fdescfs`, " "`allow.mount.fusefs`, `allow.mount.nullfs`, `allow.mount.procfs`, " "`allow.mount.linprocfs`, `allow.mount.linsysfs`, `allow.mount.tmpfs`, and " "`allow.mount.zfs`. Per man:jail[8], each child \"is effective only together " "with allow.mount and only when enforce_statfs is set to a value lower than " "2\". The convenience parameters `mount.devfs`, `mount.fdescfs`, and " "`mount.procfs` mount those filesystems for the jail automatically, and " "`mount.fstab` points at an fstab file of additional mounts." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2218 msgid "" "The `enforce_statfs` parameter controls both which mount points a jail can " "see and, through the rule above, whether the `allow.mount.*` permissions " "take effect. It takes three values:" msgstr "" #. type: Block title #: documentation/content/en/books/handbook/jails/_index.adoc:2219 #, no-wrap msgid "`enforce_statfs` values" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2222 #, no-wrap msgid "Value" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2224 #, no-wrap msgid "Mount points visible to the jail" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2225 #, no-wrap msgid "`0`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2227 #, no-wrap msgid "All mount points on the host, with no restrictions." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2228 #, no-wrap msgid "`1`" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2230 #, no-wrap msgid "Only the mount points below the jail's root directory." msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2231 #, no-wrap msgid "`2` (default)" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2232 #, no-wrap msgid "Only the single mount point where the jail's root directory is located." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2235 msgid "" "Because the `allow.mount.*` permissions require a value lower than `2`, a " "jail that must mount its own filesystems is typically configured with " "`enforce_statfs = 1`." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2237 #, no-wrap msgid "Per-Jail securelevel" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2242 msgid "" "The `securelevel` parameter sets the jail's `kern.securelevel` and raises " "the kernel's immutable-flag and device protections inside the jail. Per " "man:jail[8], \"A jail never has a lower securelevel than its parent system, " "but by setting this parameter it may have a higher one\". A network-facing " "jail can therefore run at a hardened `securelevel = 3` while the host stays " "at its default." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2244 #, no-wrap msgid "Hierarchical Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2250 msgid "" "A jail may itself create child jails, which is how nested or hierarchical " "jail hierarchies are built. The `children.max` parameter sets how many " "child jails a jail may create; it defaults to `0`, meaning no child jails " "are allowed, and the read-only `children.cur` reports how many currently " "exist. A child can never exceed the privileges of its parent: per " "man:jail[8], \"Jailed processes are not allowed to confer greater " "permissions than they themselves are given\". This makes it possible to run " "a jail manager inside a jail." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2252 #, no-wrap msgid "Empty and Persistent Jails" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2258 msgid "" "By default a jail exists only while it has running processes; when its last " "process exits, the jail disappears. Setting the `persist` parameter, in the " "words of man:jail[8], \"allows a jail to exist without any processes\". " "This is what keeps a jail alive after it has been created empty and before " "anything is populated into it, and what anchors a VNET jail that only holds " "network state. A jail can be created empty and kept alive for " "experimentation:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2262 #, no-wrap msgid "# jail -c name=test path=/rescue persist\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2265 msgid "" "Clear the flag with `nopersist` to let the jail be removed once idle again." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2267 #, no-wrap msgid "Presenting a Different OS Release" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2274 msgid "" "A jail's userland may be older than the host kernel, but tools inside it " "still read the host's version through man:uname[1] unless told otherwise. " "The `osrelease` parameter sets the string reported by the jail's " "`kern.osrelease` and `uname -r`, and `osreldate` sets the number reported by " "`kern.osreldate` and `uname -K`. Setting them so that an older userland " "reports its own release keeps man:uname[1], man:sysctl[8] consumers, and " "version-sniffing build tooling behaving correctly, including man:freebsd-" "update[8] run inside the jail. Package management is unaffected either way, " "because man:pkg[8] derives its ABI from the ELF notes of the jail's own " "binaries rather than from man:uname[1]. This complements the rule that a " "jail's userland can never be newer than the host kernel; see " "crossref:jails[jail-upgrading,\"Jail Upgrading\"]." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:2276 #, no-wrap msgid "Jails and ZFS" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2280 msgid "" "A jail can be given control of one or more ZFS datasets, allowing the jailed " "root user to create, snapshot, clone, and roll back child datasets without " "any involvement from the host administrator. This is the recommended way to " "give a jail its own writable, snapshot-capable storage." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2283 msgid "" "The host retains ownership of the dataset and only delegates management of " "the delegated tree and its descendants to the jail. The `jailed` property, " "the `zfs jail` subcommand, and the interaction between the two are described " "in crossref:zfs[zfs-zfs-jail,ZFS and Jails]." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2285 #, no-wrap msgid "Delegating a Dataset Manually" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2288 msgid "This method works on all supported releases of FreeBSD." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2290 msgid "On the host, create the dataset to delegate and mark it as jailed:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2295 #, no-wrap msgid "" "# zfs create zroot/jails/data\n" "# zfs set jailed=on zroot/jails/data\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2298 msgid "" "Setting the `jailed` property tells ZFS that the dataset will be managed " "from inside a jail, so the host stops mounting it automatically." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2301 msgid "" "Next, allow the jail to mount ZFS filesystems and attach the dataset when " "the jail is created. Add the following to the jail's section in " "[.filename]#/etc/jail.conf#:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2308 #, no-wrap msgid "" "allow.mount;\n" "allow.mount.zfs;\n" "enforce_statfs = 1;\n" "exec.created += \"zfs jail ${name} zroot/jails/data\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2313 msgid "" "The `allow.mount.zfs` permission takes effect only together with " "`allow.mount` and an `enforce_statfs` value below 2; see crossref:jails[jail-" "more-options,More Jail Options] for the mount permissions and how they " "interact with `enforce_statfs`. Because a delegated dataset is detached " "when the jail stops, the `exec.created` hook re-attaches it on every start, " "where `${name}` expands to the jail name. The same attachment can be " "performed against an already running jail with `zfs jail zroot/" "jails/data`." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2318 msgid "" "The jail needs access to [.filename]#/dev/zfs#. The default devfs ruleset " "for jails (`devfsrules_jail`, ruleset 4) already unhides it, so no custom " "devfs ruleset is required for ZFS delegation." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2321 msgid "" "Inside the jail, mount the delegated datasets and manage them like any other:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2327 #, no-wrap msgid "" "# zfs mount -a\n" "# zfs create zroot/jails/data/work\n" "# zfs snapshot zroot/jails/data/work@monday\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2330 msgid "" "The jailed root user can create, snapshot, clone, and roll back datasets " "under the delegated tree, but the `quota` property of the delegated dataset " "can only be set from the host." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2332 #, no-wrap msgid "Attaching Datasets Automatically" msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2338 msgid "" "The `zfs.dataset` parameter requires FreeBSD 15.0. It is not present in the " "man:jail[8] of FreeBSD 14.3." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2342 msgid "" "Starting with FreeBSD 15.0, man:jail[8] can attach datasets on its own, " "removing the need for the manual `jailed` and `zfs jail` steps. List the " "datasets to delegate in the `zfs.dataset` parameter:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2349 #, no-wrap msgid "" "allow.mount;\n" "allow.mount.zfs;\n" "enforce_statfs = 1;\n" "zfs.dataset = \"zroot/jails/data\";\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2353 msgid "" "man:jail[8] attaches each listed dataset when the jail starts, so the " "`exec.created` hook shown above is no longer needed. The parameter requires " "`allow.mount.zfs` to be set." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2355 msgid "" "For unmaintained jail managers that do not yet understand `zfs.dataset`, the " "rc.d/jail startup script also honors the legacy variable " "`jail__zfs_dataset` in [.filename]#/etc/rc.conf#." msgstr "" #. type: Title === #: documentation/content/en/books/handbook/jails/_index.adoc:2357 #, no-wrap msgid "Accessing Snapshots from Inside a Jail" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2361 msgid "" "The `zfs.mount_snapshot` parameter, available on FreeBSD 14.x and 15.x, lets " "jailed users reach snapshot contents without delegating a whole dataset. " "When set to `1`, jailed users may read the contents of a filesystem's " "snapshots under its [.filename]#.zfs/snapshot# directory:" msgstr "" #. type: delimited block . 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2365 #, no-wrap msgid "zfs.mount_snapshot = 1;\n" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2370 msgid "" "This is convenient for restoring individual files from host-taken " "snapshots. If `allow.mount.zfs` is also set, the snapshots may additionally " "be mounted inside the jail. The dataset's `snapdir` property controls " "whether the [.filename]#.zfs# directory is visible." msgstr "" #. type: delimited block = 4 #: documentation/content/en/books/handbook/jails/_index.adoc:2375 msgid "" "A delegated dataset combined with `allow.mount.zfs` lets the jailed root " "user set mount-related ZFS properties and mount filesystems inside the " "jail. Grant these permissions deliberately, and only to jails that are " "trusted to manage their own storage." msgstr "" #. type: Title == #: documentation/content/en/books/handbook/jails/_index.adoc:2378 #, no-wrap msgid "Jail Managers and Containers" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2381 msgid "" "As previously explained, each type of FreeBSD Jail can be created and " "configured manually, but FreeBSD also has third-party utilities to make " "configuration and administration easier." msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2383 msgid "Below is an incomplete list of the different FreeBSD Jail managers:" msgstr "" #. type: Block title #: documentation/content/en/books/handbook/jails/_index.adoc:2384 #, no-wrap msgid "Jail Managers" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2387 #, no-wrap msgid "Name" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2387 #, no-wrap msgid "License" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2387 #, no-wrap msgid "Package" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2389 #, no-wrap msgid "Documentation" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2390 #, no-wrap msgid "BastilleBSD" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2391 #: documentation/content/en/books/handbook/jails/_index.adoc:2396 #: documentation/content/en/books/handbook/jails/_index.adoc:2406 #, no-wrap msgid "BSD-3" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2392 #, no-wrap msgid "package:sysutils/bastille[]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2394 #, no-wrap msgid "link:https://bastille.readthedocs.io/en/latest/[Documentation]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2395 #, no-wrap msgid "pot" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2397 #, no-wrap msgid "package:sysutils/pot[]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2399 #, no-wrap msgid "link:https://pot.pizzamig.dev/[Documentation]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2400 #, no-wrap msgid "cbsd" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2401 #: documentation/content/en/books/handbook/jails/_index.adoc:2411 #, no-wrap msgid "BSD-2" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2402 #, no-wrap msgid "package:sysutils/cbsd[]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2404 #, no-wrap msgid "link:https://github.com/cbsd/cbsd[Documentation]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2405 #, no-wrap msgid "AppJail" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2407 #, no-wrap msgid "package:sysutils/appjail[], for devel package:sysutils/appjail-devel[]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2409 #, no-wrap msgid "link:https://github.com/DtxdF/AppJail#getting-started[Documentation]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2410 #, no-wrap msgid "iocage" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2412 #, no-wrap msgid "package:sysutils/iocage[]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2414 #, no-wrap msgid "link:https://freebsd.github.io/iocage/[Documentation]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2415 #, no-wrap msgid "ezjail" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2416 #, no-wrap msgid "link:https://erdgeist.org/beerware.html[Beer Ware]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2417 #, no-wrap msgid "package:sysutils/ezjail[]" msgstr "" #. type: Table #: documentation/content/en/books/handbook/jails/_index.adoc:2419 #, no-wrap msgid "link:https://erdgeist.org/arts/software/ezjail/[Documentation]" msgstr "" #. type: Plain text #: documentation/content/en/books/handbook/jails/_index.adoc:2421 msgid "" "FreeBSD has published official OCI base-system images since FreeBSD 14.3-" "RELEASE, and OCI (Docker-style) containers (which are built on the same jail " "technology and managed with the Podman toolkit) are covered in the " "crossref:containers[containers,Containers] chapter, which complements the " "native jails described here." msgstr ""