8 ms·

FreeBSD jails is the same concept as Docker, even it has been around for longer. Can somebody explain why it has never gained more momentum?

by Walkman 11y ago

howeyc 11y ago
Market share. FreeBSD has had jails for a long time and people using FreeBSD in production have been using them for a long time. Linux just has a lot more attention.
- digi_owl 11y ago
  Another thing is that with the BSDs companies can do like Sony has done, fork and keep proprietary. With Linux being GPL, shipping a product using it means the driver code pretty much has to be released (unless you go to the lengths that Nvidia has done to keep a shim between the kernel and their GPU code).
  - skreuzer 11y ago
    While I am sure that Sony has code that they keep proprietary, its worth noting that thy have contributed quite a bit back to FreeBSD (AVX support comes to mind) as well as LLVM.
laumars 11y ago
A more precise comparison on Linux would be OpenVZ and LXC (or Zones if you're a Solaris admin). As for why it's not gained more momentum, that would likely just be because Linux popularity dwarfs FreeBSD. Much the same reason as why so much effort was made to port ZFS to Linux despite FreeBSD already having excellent support. But for what it's worth, jails have been widely used within the FreeBSD community for quite some years. It's a great shame FreeBSD doesn't get more love because it really is a fantastic platform. But then it's just one of a long list of very credible operating systems that often get overlooked.
- CyberDildonics 11y ago
  FreeBSD seems to have the hurdle that linux had for so many years - hardware support.
  - laumars 11y ago
    Server hardware is well supported though. To be honest, anecdotally I've found desktop hardware to be pretty well supported too. Not to the level where you'd use it for gaming (gaming software support aside), but for general use it's a usable desktop. In fact I seem to recall FreeBSD working better with WiFi than Linux did, back when WiFi support in Linux was relatively new and often required using a userspace wrapper around Windows binaries. Obviously there's always room for improvement and people's experiences often differ, but I've honestly had no major issues with hardware support in the ~15 years I've been running FreeBSD.
    - cm3 11y ago
      And presumably the binary NVIDIA driver should work more smoothly because the kernel doesn't break installation of the driver at random times.
- hhw 11y ago
  Interest in FreeBSD seems to be on the rise, with the advent of systemd. Many Linux users have been able to avoid it thus far, by sticking to 6.x Of RedHat and derivatives, or Debian 7. As these versions become longer in the tooth, it will be interesting to see if more people will switch over to FreeBSD. Popularity may not be a good thing however, with the recent political drama and institution of a code of conduct getting in the way of FreeBSD's meritocratic approach. Thankfully, there's still plenty of choice available in open source operating systems. Thankfully, we can always trust Theo to keep OpenBSD's purist approach to technical correctness :P
  - beccasanchez 11y ago
    FreeBSD is going to eventually adopt a systemd-like approach. So people who switch for this reason will be betrayed down the line.
justinsaccount 11y ago
IMO, poor marketing and terrible UX. It's the same reason Solaris zones never got popular. I tried to use zones many years ago.. For "isolated services" I mostly ran things like debian VMs with 128M of ram and 4G of disk space. In theory zones could do that too, but solaris was fundamentally incompatible with the idea of running a tiny 'container' with only the software that you needed installed.
- laumars 11y ago
  OS containers will require more than just the application you want sandboxed. This is true for Solaris Zones, FreeBSD Jail, Linux OpenVZ or LXC (Linux Containers). And that's fine because the concept is akin to running a VM across a shared kernel rather than abstracting the hardware via a hypervisor. So you're effectively chrooting a sub-OS inside the host. As for your comments regarding Solaris, I was using Solaris Zones about a decade ago and, inversely to your experience, I found the whole process really easy. In fact it was on Solaris where I first learned about OS containers and which really convinced me to adopt them to many other projects over the years since. To be honest, it is really weird reading your comment as my experiences couldn't differ more. If your memory is up to the job, I'd be curious to read more detail about the issues you had.
  - justinsaccount 11y ago
    Sure.. Creating a zone was easy, it was managing it that was impossible. So the way I used to use debian was I was using xen. If I needed something like a tftp server, I would bring up a tiny VM with nothing but the base debian system installed. Then I would simply apt-get install tftp-server-whatever (via puppet) and call it a day. Since all it was running was sshd+syslog+postfix(bound to lo) and the tftp server, patching was easy. I didn't have to deal with managing updates for 2000 packages that I was not using. I could also upgrade each vm separately. Zones did not work that way at all. You could do a 'sparse' zone, which would inherit some directories from the host system, or whatever the opposite of that was that would just go and install a full 4G+ solaris system into the zone. When I complained about the fact 'single use' zones had to have 4G of software installed, I was told to just use clones, which did not use extra disk space. The problem is those full clones then needed to be patched. It was basically impossible to create a small single purpose zone that did not contain 4G of software and was easy to manage. The sparse zones were not usable because then you could not install or update software in isolation. I see the same thing on the ez-jail page: > Because the basejail's copy of the userland is shared by the other jails, updating the basejail automatically updates all of the other jails. Either source or binary updates can be used. So, if an update to basejail breaks something, it breaks every jail linked to it? What if I want to test my software on FreeBSD+1? Really, the problem wasn't the zone technology, the problem was the horrible user-hostile solaris userland. This is why Triton appeals to people.
Thaxll 11y ago
The power of Docker is not the jail itself but the workflow to deploy apps. There is none of that in BSD jails.
- craftkiller 11y ago
  Actually there is, and its called "docker" :-) . Docker has been ported to FreeBSD using jails https://wiki.freebsd.org/Docker https://wiki.freebsd.org/Docker
  - sdnguyen90 11y ago
    My experience as a new FreeBSD user: if you're expecting the Docker port stability to be remotely close to Linux, I'd avoid using for now.
gh02t 11y ago
I'd say jails aren't quite the same thing as Docker, they're much closer to LXC. They're really much closer to the "chroot on steroids" promise in that they're basically lightweight virtual machines and are actually intended to be used as such. For instance jails usually run the full FreeBSD init system, while it's [sort of] discouraged to do that with Docker. On the other hand, I associate Docker more with the machinery it builds on top of containers. It's got all the snapshotting and build/distribution infrastructure. I think popular wisdom is also only to run a single process in a Docker container, whereas most people I've seen (myself included) treat jails a lot like a virtual machine. Jails are really popular amongst FreeBSD users and I use them a lot myself, but FreeBSD is nowhere near as popular as Linux, so that's one thing that held it back. Also, I think a big part of what has made Docker popular is all the deployment and distribution stuff on top of bare containers. The whole Docker philosophy of mostly immutable containers and microservices was what people wanted and FreeBSD jails aren't really intended for that.
- the8472 11y ago
  Another comparison point in linux land would be firejail https://firejail.wordpress.com/ https://firejail.wordpress.com/
- SFjulie1 11y ago
  Docker is marketing based. Jails are engineering based. It may make no difference to you, but it is the same difference between religion and science. You don't hide problem behind nice easy tools easily deployable, you do it the hard way. And as BSD says: jails are strong cages, but they are made of glasses, and when they break, it breaks badly. Engineers don't believe in reassuring technology, they control them and do not fear the ugly details, they are aware of the domain of validity, accept imperfections and do not hide them under stickers, propaganda and success stories. They do risk control, they right manuals and point out weaknesses. Jails user at least know this solution is a brass bullet and can fail you. And sometimes good users worth more than good technologies. A good soldier is valuable more than good weapons. That's why early adoptant of linux are going to BSD. To get the control back and go back to basic engineering approaches that are stable. I learnt in this process that you can learn from the mistakes that made linux fail the community : evangelization, consensus, philosophical approach, over-promising and being nice.
rsync 11y ago
"FreeBSD jails is the same concept as Docker, even it has been around for longer. Can somebody explain why it has never gained more momentum?" The very first VPS provider[1] based their offering on jail and FreeBSD. They still offer them today (I sold the business in 2004). We didn't call them "VPS" - that term came about later, in 2002 I think ... we called them "server instances". We also didn't have any of these nifty deployment/monitoring/management tools - there was nothing but jail(8). [1] JohnCompanies in 2001.
jstoiko 11y ago
It has. Jails have always been very popular in the FreeBSD world.
clinta 11y ago
Author here. I'm just now diving into docker. Docker is really about the images. Docker can run on lxc or in kernel namespaces. And there is ongoing work to port Docker to FreeBSD where Docker images will run in jails. But apparently it took Docker image format and registry to make it popular enough among developers to make contanerization the old new big thing.
- cthalupa 11y ago
  >Docker can run on lxc or in kernel namespaces. This is kind of an odd statement. All lxc is is userspace tools for managing namespaces and cgroups. If you're using lxc, you're still running on kernel namespaces
  - clinta 11y ago
    True, I should have said it can use lxc (which they used to use by default) or their own libcontainer to manage kernel namespaces. And I'm not sure what they're using to manage containers on Windows.

FreeBSD jails is the same concept as Docker, even it has been around for longer. Can somebody explain why it has never gained more momentum?

by Walkman 11y ago

FreeBSD jails is the same concept as Docker, even it has been around for longer. Can somebody explain why it has never gained more momentum?

howeyc 11y ago

Market share. FreeBSD has had jails for a long time and people using FreeBSD in production have been using them for a long time. Linux just has a lot more attention.

digi_owl 11y ago
Another thing is that with the BSDs companies can do like Sony has done, fork and keep proprietary. With Linux being GPL, shipping a product using it means the driver code pretty much has to be released (unless you go to the lengths that Nvidia has done to keep a shim between the kernel and their GPU code).
- skreuzer 11y ago
  While I am sure that Sony has code that they keep proprietary, its worth noting that thy have contributed quite a bit back to FreeBSD (AVX support comes to mind) as well as LLVM.

laumars 11y ago

A more precise comparison on Linux would be OpenVZ and LXC (or Zones if you're a Solaris admin). As for why it's not gained more momentum, that would likely just be because Linux popularity dwarfs FreeBSD. Much the same reason as why so much effort was made to port ZFS to Linux despite FreeBSD already having excellent support. But for what it's worth, jails have been widely used within the FreeBSD community for quite some years. It's a great shame FreeBSD doesn't get more love because it really is a fantastic platform. But then it's just one of a long list of very credible operating systems that often get overlooked.

CyberDildonics 11y ago
FreeBSD seems to have the hurdle that linux had for so many years - hardware support.
- laumars 11y ago
  Server hardware is well supported though. To be honest, anecdotally I've found desktop hardware to be pretty well supported too. Not to the level where you'd use it for gaming (gaming software support aside), but for general use it's a usable desktop. In fact I seem to recall FreeBSD working better with WiFi than Linux did, back when WiFi support in Linux was relatively new and often required using a userspace wrapper around Windows binaries. Obviously there's always room for improvement and people's experiences often differ, but I've honestly had no major issues with hardware support in the ~15 years I've been running FreeBSD.
  - cm3 11y ago
    And presumably the binary NVIDIA driver should work more smoothly because the kernel doesn't break installation of the driver at random times.
hhw 11y ago
Interest in FreeBSD seems to be on the rise, with the advent of systemd. Many Linux users have been able to avoid it thus far, by sticking to 6.x Of RedHat and derivatives, or Debian 7. As these versions become longer in the tooth, it will be interesting to see if more people will switch over to FreeBSD. Popularity may not be a good thing however, with the recent political drama and institution of a code of conduct getting in the way of FreeBSD's meritocratic approach. Thankfully, there's still plenty of choice available in open source operating systems. Thankfully, we can always trust Theo to keep OpenBSD's purist approach to technical correctness :P
- beccasanchez 11y ago
  FreeBSD is going to eventually adopt a systemd-like approach. So people who switch for this reason will be betrayed down the line.

justinsaccount 11y ago

IMO, poor marketing and terrible UX. It's the same reason Solaris zones never got popular. I tried to use zones many years ago.. For "isolated services" I mostly ran things like debian VMs with 128M of ram and 4G of disk space. In theory zones could do that too, but solaris was fundamentally incompatible with the idea of running a tiny 'container' with only the software that you needed installed.

laumars 11y ago
OS containers will require more than just the application you want sandboxed. This is true for Solaris Zones, FreeBSD Jail, Linux OpenVZ or LXC (Linux Containers). And that's fine because the concept is akin to running a VM across a shared kernel rather than abstracting the hardware via a hypervisor. So you're effectively chrooting a sub-OS inside the host. As for your comments regarding Solaris, I was using Solaris Zones about a decade ago and, inversely to your experience, I found the whole process really easy. In fact it was on Solaris where I first learned about OS containers and which really convinced me to adopt them to many other projects over the years since. To be honest, it is really weird reading your comment as my experiences couldn't differ more. If your memory is up to the job, I'd be curious to read more detail about the issues you had.
- justinsaccount 11y ago
  Sure.. Creating a zone was easy, it was managing it that was impossible. So the way I used to use debian was I was using xen. If I needed something like a tftp server, I would bring up a tiny VM with nothing but the base debian system installed. Then I would simply apt-get install tftp-server-whatever (via puppet) and call it a day. Since all it was running was sshd+syslog+postfix(bound to lo) and the tftp server, patching was easy. I didn't have to deal with managing updates for 2000 packages that I was not using. I could also upgrade each vm separately. Zones did not work that way at all. You could do a 'sparse' zone, which would inherit some directories from the host system, or whatever the opposite of that was that would just go and install a full 4G+ solaris system into the zone. When I complained about the fact 'single use' zones had to have 4G of software installed, I was told to just use clones, which did not use extra disk space. The problem is those full clones then needed to be patched. It was basically impossible to create a small single purpose zone that did not contain 4G of software and was easy to manage. The sparse zones were not usable because then you could not install or update software in isolation. I see the same thing on the ez-jail page: > Because the basejail's copy of the userland is shared by the other jails, updating the basejail automatically updates all of the other jails. Either source or binary updates can be used. So, if an update to basejail breaks something, it breaks every jail linked to it? What if I want to test my software on FreeBSD+1? Really, the problem wasn't the zone technology, the problem was the horrible user-hostile solaris userland. This is why Triton appeals to people.

Thaxll 11y ago

The power of Docker is not the jail itself but the workflow to deploy apps. There is none of that in BSD jails.

craftkiller 11y ago
Actually there is, and its called "docker" :-) . Docker has been ported to FreeBSD using jails https://wiki.freebsd.org/Docker https://wiki.freebsd.org/Docker
- sdnguyen90 11y ago
  My experience as a new FreeBSD user: if you're expecting the Docker port stability to be remotely close to Linux, I'd avoid using for now.

gh02t 11y ago

I'd say jails aren't quite the same thing as Docker, they're much closer to LXC. They're really much closer to the "chroot on steroids" promise in that they're basically lightweight virtual machines and are actually intended to be used as such. For instance jails usually run the full FreeBSD init system, while it's [sort of] discouraged to do that with Docker. On the other hand, I associate Docker more with the machinery it builds on top of containers. It's got all the snapshotting and build/distribution infrastructure. I think popular wisdom is also only to run a single process in a Docker container, whereas most people I've seen (myself included) treat jails a lot like a virtual machine. Jails are really popular amongst FreeBSD users and I use them a lot myself, but FreeBSD is nowhere near as popular as Linux, so that's one thing that held it back. Also, I think a big part of what has made Docker popular is all the deployment and distribution stuff on top of bare containers. The whole Docker philosophy of mostly immutable containers and microservices was what people wanted and FreeBSD jails aren't really intended for that.

the8472 11y ago
Another comparison point in linux land would be firejail https://firejail.wordpress.com/ https://firejail.wordpress.com/
SFjulie1 11y ago
Docker is marketing based. Jails are engineering based. It may make no difference to you, but it is the same difference between religion and science. You don't hide problem behind nice easy tools easily deployable, you do it the hard way. And as BSD says: jails are strong cages, but they are made of glasses, and when they break, it breaks badly. Engineers don't believe in reassuring technology, they control them and do not fear the ugly details, they are aware of the domain of validity, accept imperfections and do not hide them under stickers, propaganda and success stories. They do risk control, they right manuals and point out weaknesses. Jails user at least know this solution is a brass bullet and can fail you. And sometimes good users worth more than good technologies. A good soldier is valuable more than good weapons. That's why early adoptant of linux are going to BSD. To get the control back and go back to basic engineering approaches that are stable. I learnt in this process that you can learn from the mistakes that made linux fail the community : evangelization, consensus, philosophical approach, over-promising and being nice.

rsync 11y ago

"FreeBSD jails is the same concept as Docker, even it has been around for longer. Can somebody explain why it has never gained more momentum?" The very first VPS provider[1] based their offering on jail and FreeBSD. They still offer them today (I sold the business in 2004). We didn't call them "VPS" - that term came about later, in 2002 I think ... we called them "server instances". We also didn't have any of these nifty deployment/monitoring/management tools - there was nothing but jail(8). [1] JohnCompanies in 2001.

jstoiko 11y ago

It has. Jails have always been very popular in the FreeBSD world.

clinta 11y ago

Author here. I'm just now diving into docker. Docker is really about the images. Docker can run on lxc or in kernel namespaces. And there is ongoing work to port Docker to FreeBSD where Docker images will run in jails. But apparently it took Docker image format and registry to make it popular enough among developers to make contanerization the old new big thing.

cthalupa 11y ago
>Docker can run on lxc or in kernel namespaces. This is kind of an odd statement. All lxc is is userspace tools for managing namespaces and cgroups. If you're using lxc, you're still running on kernel namespaces
- clinta 11y ago
  True, I should have said it can use lxc (which they used to use by default) or their own libcontainer to manage kernel namespaces. And I'm not sure what they're using to manage containers on Windows.