3 ms·

Are there significant differences in usability between BSD jails and LXC?

krenoten 11y ago
http://unix.stackexchange.com/questions/127001/linux-lxc-vs-freebsd-jail http://unix.stackexchange.com/questions/127001/linux-lxc-vs-...
lobster_johnson 11y ago
There's little technical difference. Both BSD and Linux provide set of kernel-level mechanisms that allow you to run "containers", ie. process trees that are completely isolated from each other and from the host OS. They are roughly comparable, I believe, with mostly minor technical differences. The huge practical difference right now is that on Linux, Docker and LXC (as in linuxcontainers.org) provide a high-level, fairly opinioned framework and set of infrastructure pieces to build, run and manage containers — and there are no fully equivalent tools on BSD, at least none that are as featureful or mature. If you want to do containerized deploys on BSD, you'll be writing scripts that set up jails, call rctl, set kernel parameters with sysctl, and so on. There's ezjail [1], but it's nowhere near Docker in terms of scope. I actually wish there was something on Linux that was less monolithic and better designed than Docker. Its image management is badly designed and annoying to use, and after all this time it still suffers from design flaws such as needing to be the parent of all containers (completely unnecessary given that we have cgroups). [1] https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-ezjail.html https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/j...
- floatboth 11y ago
  http://doger.io http://doger.io has links to a lot of simple Linux container runners! I'm working on a simple FreeBSD jail runner: https://github.com/myfreeweb/sandblast https://github.com/myfreeweb/sandblast The main idea is machine-friendly configuration: your higher level software (PaaS, CI, etc.) produces a JSON config and pipes it to sandblast, which runs a script in the container.
- toast0 11y ago
  I have a piece of software running in jails on our servers, I wrote a script to assemble the jail (although this could just be expanding a tar file, and copying in the service configuration file), and add to jail.conf, (maybe add to rc.conf.local if you want to autostart). I didn't need to sysctl, or rctl. I also wrote a small rc file (that just calls /usr/sbin/jail -c name to start, and jail -r name to stop) in jail.conf i just have stud { path = "/usr/local/jails/jail_name"; ip4 = "inherit"; host.hostname = "jail_name.example.net"; securelevel = 4; devfs_ruleset = 10; exec.start = "/bin/service --config=/etc/service.conf"; mount.devfs; exec.system_jail_user; exec.jail_user=jail_name; exec.poststart="/usr/local/bin/jail_ipfw"; } (ok, i also setup a devfs rule, because i had issues with built in ones and various patch levels of FreeBSD -- and my service needs access to /dev/random) The only non-obvious thing is you need /libexec/ld-elf.so.1 in order to run dynamically linked libraries.
- JdeBP 11y ago
  > There's ezjail [1], but ... There's also the PC-BSD Warden. With it, one generally does not write scripts to "set up jails, call rctl, set kernel parameters with sysctl". See the PC-BSD 10.1 Handbook chapter 8: * http://download.pcbsd.org/iso/10.1-RELEASE/amd64/docs/html/controlpanel.html#warden http://download.pcbsd.org/iso/10.1-RELEASE/amd64/docs/html/c...
joshbaptiste 11y ago
BSD Jails were built with security in mind, LXC is now improving the security model as the prominence of Docker has shed light on it.

http://unix.stackexchange.com/questions/127001/linux-lxc-vs-freebsd-jail http://unix.stackexchange.com/questions/127001/linux-lxc-vs-...

lobster_johnson 11y ago

There's little technical difference. Both BSD and Linux provide set of kernel-level mechanisms that allow you to run "containers", ie. process trees that are completely isolated from each other and from the host OS. They are roughly comparable, I believe, with mostly minor technical differences. The huge practical difference right now is that on Linux, Docker and LXC (as in linuxcontainers.org) provide a high-level, fairly opinioned framework and set of infrastructure pieces to build, run and manage containers — and there are no fully equivalent tools on BSD, at least none that are as featureful or mature. If you want to do containerized deploys on BSD, you'll be writing scripts that set up jails, call rctl, set kernel parameters with sysctl, and so on. There's ezjail [1], but it's nowhere near Docker in terms of scope. I actually wish there was something on Linux that was less monolithic and better designed than Docker. Its image management is badly designed and annoying to use, and after all this time it still suffers from design flaws such as needing to be the parent of all containers (completely unnecessary given that we have cgroups). [1] https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-ezjail.html https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/j...

floatboth 11y ago
http://doger.io http://doger.io has links to a lot of simple Linux container runners! I'm working on a simple FreeBSD jail runner: https://github.com/myfreeweb/sandblast https://github.com/myfreeweb/sandblast The main idea is machine-friendly configuration: your higher level software (PaaS, CI, etc.) produces a JSON config and pipes it to sandblast, which runs a script in the container.
toast0 11y ago
I have a piece of software running in jails on our servers, I wrote a script to assemble the jail (although this could just be expanding a tar file, and copying in the service configuration file), and add to jail.conf, (maybe add to rc.conf.local if you want to autostart). I didn't need to sysctl, or rctl. I also wrote a small rc file (that just calls /usr/sbin/jail -c name to start, and jail -r name to stop) in jail.conf i just have stud { path = "/usr/local/jails/jail_name"; ip4 = "inherit"; host.hostname = "jail_name.example.net"; securelevel = 4; devfs_ruleset = 10; exec.start = "/bin/service --config=/etc/service.conf"; mount.devfs; exec.system_jail_user; exec.jail_user=jail_name; exec.poststart="/usr/local/bin/jail_ipfw"; } (ok, i also setup a devfs rule, because i had issues with built in ones and various patch levels of FreeBSD -- and my service needs access to /dev/random) The only non-obvious thing is you need /libexec/ld-elf.so.1 in order to run dynamically linked libraries.
JdeBP 11y ago
> There's ezjail [1], but ... There's also the PC-BSD Warden. With it, one generally does not write scripts to "set up jails, call rctl, set kernel parameters with sysctl". See the PC-BSD 10.1 Handbook chapter 8: * http://download.pcbsd.org/iso/10.1-RELEASE/amd64/docs/html/controlpanel.html#warden http://download.pcbsd.org/iso/10.1-RELEASE/amd64/docs/html/c...

joshbaptiste 11y ago

BSD Jails were built with security in mind, LXC is now improving the security model as the prominence of Docker has shed light on it.