6 ms·

FreeBSD's Jails doesnt allow raw socket access by default since i have been using it (~10Y) and probably even much longer. edit: Since 2004 to be precise. htt

FreeBSD's Jails doesnt allow raw socket access by default since i have been using it (~10Y) and probably even much longer. edit: Since 2004 to be precise. https://www.freebsd.org/releases/5.3R/relnotes-amd64.html https://www.freebsd.org/releases/5.3R/relnotes-amd64.html So well documented. Gotta love it.

bthornbury 9y ago
How does the isolation compare with docker in general? Not familiar with freeBSD jails.
- boomboomsubban 9y ago
  I'm sure this isn't a total list of features, but Wikipedia's comparison shows jails having all the features of Docker. https://en.wikipedia.org/wiki/Operating-system-level_virtualization#Implementations https://en.wikipedia.org/wiki/Operating-system-level_virtual...
  - c0n5pir4cy 9y ago
    As someone who has used both extensively. I wouldn't say Docker and Jails are directly comparable; Jails are a lot more comparable to something like LXC. Jails doesn't have any of the deployment, tools for creating images, building of images, registry for images etc. Docker also automates a lot of networking stuff away whereas with jails I usually have to use something like PF to set up port forwards; I also sometimes run into problems with the fact it shares the network stack with the host. That being said, all the configuration is quite simple and building exactly what I need for running an application isn't too difficult. The big advantage after that being that I understand how everything is wired together and I can debug easier when something goes wrong. Doing it manually however takes up much more time.
    - deleted 9y ago
      [deleted]
    - boomboomsubban 9y ago
      Terribly late reply, sorry, but the deployment tools are all in ZFS. Giving each jail it's own ZFS file system let's you have templates with a bunch of steps done, or mass copy a complete jail. And with ZFS send/receive, you can share them.
- icebraining 9y ago
  Docker is a high-level container management tool, which uses container execution technologies underneath. Initially they used LXC, which is comparable to Jails, and in fact there's someone porting Docker to use FreeBSD Jails: https://github.com/kvasdopil/docker/blob/freebsd-compat/FREEBSD-PORTING.md https://github.com/kvasdopil/docker/blob/freebsd-compat/FREE...
geofft 9y ago
Does ping or traceroute work in jails by default? It sounds like the Docker folks aren't thrilled with enabling raw sockets by default, but enough people expect outbound ping to work. (Linux's network stack does have an unprivileged ping, controlled by setting sysctl net.ipv4.ping_group_range appropriately; recent ping binaries support using it but I think most distros don't enable the sysctl. I'm guessing Docker could enable it within containers if they weren't worried about older distros that predate this support in ping.)
- toast0 9y ago
  Not by default. I've run two kinds of jails: a) I didn't need much separation, I just wanted to run multiple environments on one box to save hardware; in this case, I enabled raw sockets, because it was convenient to ssh into the virtual environment and ping things. b) things that I wanted really separate; for these environments, I left raw sockets disabled, the jail only contains the one executable (statically compiled); additionally, I also setup ipfw rules to prevent IP traffic from the jail from getting in or out, other than the specific things it was intended to do.
  - aidenn0 9y ago
    Does disabling raw sockets still allow the various IPv6 ICMP messages that can be necessary for things like PMTU discovery to happen?
    - gtirloni 9y ago
      Supposedly, that happens a layer below the socket API so restricting the creation of raw sockets by userland shouldn't have an impact.
    - toast0 9y ago
      It shouldn't -- the permission is for user mode programs to access raw sockets, and user mode programs aren't needed to generate and handle normal MTU ICMPs (on both IPv4 and IPv6).

bthornbury 9y ago

How does the isolation compare with docker in general? Not familiar with freeBSD jails.

boomboomsubban 9y ago
I'm sure this isn't a total list of features, but Wikipedia's comparison shows jails having all the features of Docker. https://en.wikipedia.org/wiki/Operating-system-level_virtualization#Implementations https://en.wikipedia.org/wiki/Operating-system-level_virtual...
- c0n5pir4cy 9y ago
  As someone who has used both extensively. I wouldn't say Docker and Jails are directly comparable; Jails are a lot more comparable to something like LXC. Jails doesn't have any of the deployment, tools for creating images, building of images, registry for images etc. Docker also automates a lot of networking stuff away whereas with jails I usually have to use something like PF to set up port forwards; I also sometimes run into problems with the fact it shares the network stack with the host. That being said, all the configuration is quite simple and building exactly what I need for running an application isn't too difficult. The big advantage after that being that I understand how everything is wired together and I can debug easier when something goes wrong. Doing it manually however takes up much more time.
  - deleted 9y ago
    [deleted]
  - boomboomsubban 9y ago
    Terribly late reply, sorry, but the deployment tools are all in ZFS. Giving each jail it's own ZFS file system let's you have templates with a bunch of steps done, or mass copy a complete jail. And with ZFS send/receive, you can share them.
icebraining 9y ago
Docker is a high-level container management tool, which uses container execution technologies underneath. Initially they used LXC, which is comparable to Jails, and in fact there's someone porting Docker to use FreeBSD Jails: https://github.com/kvasdopil/docker/blob/freebsd-compat/FREEBSD-PORTING.md https://github.com/kvasdopil/docker/blob/freebsd-compat/FREE...

geofft 9y ago

Does ping or traceroute work in jails by default? It sounds like the Docker folks aren't thrilled with enabling raw sockets by default, but enough people expect outbound ping to work. (Linux's network stack does have an unprivileged ping, controlled by setting sysctl net.ipv4.ping_group_range appropriately; recent ping binaries support using it but I think most distros don't enable the sysctl. I'm guessing Docker could enable it within containers if they weren't worried about older distros that predate this support in ping.)

toast0 9y ago
Not by default. I've run two kinds of jails: a) I didn't need much separation, I just wanted to run multiple environments on one box to save hardware; in this case, I enabled raw sockets, because it was convenient to ssh into the virtual environment and ping things. b) things that I wanted really separate; for these environments, I left raw sockets disabled, the jail only contains the one executable (statically compiled); additionally, I also setup ipfw rules to prevent IP traffic from the jail from getting in or out, other than the specific things it was intended to do.
- aidenn0 9y ago
  Does disabling raw sockets still allow the various IPv6 ICMP messages that can be necessary for things like PMTU discovery to happen?
  - gtirloni 9y ago
    Supposedly, that happens a layer below the socket API so restricting the creation of raw sockets by userland shouldn't have an impact.
  - toast0 9y ago
    It shouldn't -- the permission is for user mode programs to access raw sockets, and user mode programs aren't needed to generate and handle normal MTU ICMPs (on both IPv4 and IPv6).