Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
digitalcourage.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Diese Instanz wird betrieben von Digitalcourage e.V. für die Allgemeinheit. Damit wir das nachhaltig tun können, erheben wir einen jährlichen Vorausbeitrag von 1€/Monat per SEPA-Lastschrifteinzug.

Administered by:

Server stats:

818
active users

digitalcourage.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.8

#jails

9 posts4 participants0 posts today
Public
Larvitz :fedora: :redhat:

After some days of troubleshooting FreeBSD networking and pf firewalling (and learning a lot in the process!), I finally made an article about FreeBSD VNet jails behind a dedicated firewall jail, that works with both IPv4 AND IPv6:

Internet <-> firewall-jail <-> application jail

I hope, someone might find that helpful. The detailed article is here in my Codeberg gists:

codeberg.org/Larvitz/gists/src

My next step is trying to get IPv6 address support into the marvelous tool jmore from @vermaden and sending him a pull-request for that :)

#bsd#freebsd#jails
Replied to Larvitz :fedora: :redhat:
Public
stafwag

@Larvitz

It's still on my "to-do" to try/review it, but you might like:

github.com/austinhyde/ansible-

It allows to manage the #FreeBSD #jails through an SSH connection on the Jail host.

You can also use #OCI #Docker style containers on FreeBSD. Even #Linux containers work on FreeBSD.

I don't think there is solution to run FreeBSD containers on #Linux ;-)

An Ansible connection plugin for provisioning FreeBSD jails remotely - austinhyde/ansible-sshjail
GitHubGitHub - austinhyde/ansible-sshjail: An Ansible connection plugin for provisioning FreeBSD jails remotelyAn Ansible connection plugin for provisioning FreeBSD jails remotely - austinhyde/ansible-sshjail
Public *
Larvitz :fedora: :redhat:

After a while of fiddling, I got dual-stack for FreeBSD (IPv4 and IPv6) VNet Jails working properly and reliably 🙂

The important lessons, I've learned:

/etc/sysctl.conf:
+net.link.bridge.inherit_mac=1

/boot/loader.conf:
+if_epair_load="YES"

/etc/rc.conf:
+create_args_bridge0="inet6 auto_linklocal -ifdisabled addm vtnet0"
+ifconfig_vtnet0="up -tso -vlanhwtso"
+rtsold_enable="YES"
+rtsold_flags="-i -m bridge0"

Then, configuring ifconfig_bridge0_ipv6 as well as ipv6_defaultrouter for the host to have IPv6 connectivity as well as the network-configuration in the jail via $jail/etc/rc.conf (The jail of course needs it's own IP on the same subnet as the host)

Screenshots of the fully working configuration with a connectivity test are attached :-)

#freebsd#jails#vnet
Continued thread
Public
Larvitz :fedora: :redhat:

I use Jails with Ansible to automate their creation, their lifecycle management and automation of the jailed applications and I highly enjoy, how comfortable and easy it is.

No immutable images, no “Dockerfiles”, no weird volume mounts or image registries and no constant re-creation of images and new deployments just to update something. Just some simple, well isolated operating systems to run my applications in 🙂

I don’t say that Linux containers are bad. There’s for sure situations, where they shine. Just for my personal use-case, they are more effort in comparison to BSD jails and I’m a fan of “using the right tool for a task”

And the idempotent nature of Ansible automation makes it easy to describe them in a declarative way and manage them at scale.

#linux#container#freebsd
Public
Larvitz :fedora: :redhat:

Linux containers (OCI Containers) are ephemeral by design, except the volumes, you mount into them. In large scale environments, that can be useful (cattle vs pets argument). But that also introduces new challenges and makes it more complex to manage them.

For my personal environments, I like the approach of FreeBSD jails more. They are just a directory (or ZFS Dataset) with their own, persistent copy of the OS, easy to manage and the networking capabilities are flexible (bridged, vnet, they can be routed, firewalled, etc).

Jails are well aged, are around since FreeBSD 4 back in 2000, the non-ephemeral approach (and the absence of overlay file systems etc) makes them more feel like individual virtual servers than modern Linux containers but with extreme levels of flexibility.

Tools like jmore(8) (by @vermaden) and Bastille (Jails “Templates”) makes them even easier to manage.

#linux#container#freebsd
Continued thread
Public
Nonilex

#NYC has held onto its control of #RikersIsland w/white knuckles — struggling to show progress & reaching the brink of losing #oversight of the #jails as critics of the system called for an outside authority. Conditions have not improved, acc/to lawyers for the plaintiffs & the federal monitor.

NYC has spent >$500k per inmate annually in recent years, acc/to city data, well beyond what other large cities have spent, & yet detainees still sometimes go without food or proper medical care.

#law
Continued thread
Public
Nonilex

The official, called a remediation manager, will work with the #NYC correction commissioner, but be “empowered to take all actions necessary” to turn around the city’s #jails, Judge Swain wrote.

“While the necessary changes will take some time, the court expects to see continual progress toward these goals,” she wrote.

#law#PrisonReform#RikersIsland
Public
Nonilex

A federal judge overseeing #NYC’s #jails took #RikersIsland out of the city’s control on Tues, ordering that an outside official be appointed to make major decisions regarding the troubled & violent #jail complex.

The judge, Laura Taylor Swain, said in a 77-page ruling that the official would report directly to her & would not be a city employee, turning aside Mayor #EricAdams’ efforts to maintain control of the lockups.

#law #PrisonReform
nytimes.com/2025/05/13/nyregio

New York City has spent more than $500,00 per inmate annually in recent years, but detainees still sometimes go without food or medical care.
The New York Times · Judge Appoints Outside Official to Take Over Deadly Rikers Island JailBy Hurubie Meko
Public *
Felix Palmen :freebsd: :c64:

My phone very suddenly died 3 months ago. But my old one was still working and so far I'm using it, still waiting to find a good offer for a new phone. Well, now my banking app stopped working (too old), but I can't upgrade either (android too old) ... sucks.

I need a new phone ASAP, but I needed an even quicker solution to use this app.

Luckily, I already have a #FreeBSD server with #bhyve and some #guacamole installation using #jails. With that, I could install #BlissOS 🥳 (and even access it from my company's notebook)

BlissOS runing on a FreeBSD server in bhyve, displayed in MS Edge on Windows 10 via guacamole
Public
ivy

i could really do with a #network and/or #jails review on D49843 if anyone feels like doing that. i’m pretty sure i am in the right here, but i won't get mentor approval to commit unless someone supports it.

#freebsd
Continued thread
Public
Marcel Stritzelberger

Der Server wurde bereits gebucht und ist vorbereitet. Natürlich wird es ein #FreeBSD Server, wo alle Dienste in getrennten #Jails liegen werden. Hintergründe und Anleitung werden wie immer hier und auf der bsdbox.de veröffentlicht.

Es werden weiterhin #Moderatoren gesucht, die Spass daran haben, eine neue Community in #nrw #mettmann #velbert #wülfrath #velbert #heiligenhaus mit aufzubauen #fediverse

Gerne #boosten , schreibt mir wenn ihr Bock habt.

Public
Lars E

Today I saw that since Bastille's last release at the end of January there have been 625(!) commits to the repo. Many bug fixes, new features, subcommands, doc updates (💜), ...
Big props to Victor for working tiredlessly on the project. github.com/BastilleBSD/bastill

Also, there have been some new videos on Bastille's Youtube channel: youtube.com/@BastilleBSD demonstration upcoming features in Bastille 0.14.

GitHubGitHub - BastilleBSD/bastille: Bastille is an open-source system for automating deployment and management of containerized applications on FreeBSD.Bastille is an open-source system for automating deployment and management of containerized applications on FreeBSD. - BastilleBSD/bastille
#FreeBSD#Jails#Bastille
ExploreLive feeds
About