6 ms·

Anybody know what the benefits of a BSD jail might be over a VM?

simcop2387 7y ago
lighter weight than a VM. It uses the same kernel as the rest of the system, but sandboxes the userspace to limit what impact it can have on the rest of the system. They're not quite equivalent to a container on Linux but they're very similar in functionality.
- Lammy 7y ago
  VNET jails, as the author is using, also have a completely stand-alone network stack from the host-OS!
- nine_k 7y ago
  Aren't cgroups / containers a very close equivalent? In either case, it's namespacing, of a tree of userspace processes to make them invisible from the rest of the userspace.
pacija 7y ago
FreeBSD jails are additional jailed (chrooted) userlands using kernel of the host. They can be as fat as complete FreeBSD userland, or as thin as just a few binaries and libraries necessary to run particular service. https://www.freebsd.org/doc/handbook/jails.html https://www.freebsd.org/doc/handbook/jails.html
- tachion 7y ago
  They're much more than just a chroot (that's a concept of limiting your process filesystem access), can have their own TCP stack, their own firewall, their resource usage limits and so on. They are much, much closer to Linux containers, than to chroot actually.
  - pacija 7y ago
    You are right about them being much more than chroot, the ability to limit device access and set other resource limits has been possible since a long time ago. VNET jails, introduced fairly recently (12.0-RELEASE with GENERIC kernel, 11.0-RELEASE with custom compiled kernel if I'm not mistaken), can have their own TCP stack and firewall. I am not familiar with Linux containers, but I read that FreeBSD jails are much, much different from them. As for chroot, it still plays crucial role in FreeBSD jail implementation.
rooam-dev 7y ago
Still learning, but the diff would be similar between VMs and Containers on Linux.
StreamBright 7y ago
Apples and oranges. Jails to not support any other operating system than the host.
- loeg 7y ago
  > Jails to not support any other operating system than the host. This oversimplifies. The kernel is the same in the jail and the host. But FreeBSD has a Linux syscall emulation layer, and you can definitely install a Linux userspace in a jail and run essentially Linux-but-the-kernel in the jail.

lighter weight than a VM. It uses the same kernel as the rest of the system, but sandboxes the userspace to limit what impact it can have on the rest of the system. They're not quite equivalent to a container on Linux but they're very similar in functionality.

Lammy 7y ago
VNET jails, as the author is using, also have a completely stand-alone network stack from the host-OS!
nine_k 7y ago
Aren't cgroups / containers a very close equivalent? In either case, it's namespacing, of a tree of userspace processes to make them invisible from the rest of the userspace.

pacija 7y ago

FreeBSD jails are additional jailed (chrooted) userlands using kernel of the host. They can be as fat as complete FreeBSD userland, or as thin as just a few binaries and libraries necessary to run particular service. https://www.freebsd.org/doc/handbook/jails.html https://www.freebsd.org/doc/handbook/jails.html

tachion 7y ago
They're much more than just a chroot (that's a concept of limiting your process filesystem access), can have their own TCP stack, their own firewall, their resource usage limits and so on. They are much, much closer to Linux containers, than to chroot actually.
- pacija 7y ago
  You are right about them being much more than chroot, the ability to limit device access and set other resource limits has been possible since a long time ago. VNET jails, introduced fairly recently (12.0-RELEASE with GENERIC kernel, 11.0-RELEASE with custom compiled kernel if I'm not mistaken), can have their own TCP stack and firewall. I am not familiar with Linux containers, but I read that FreeBSD jails are much, much different from them. As for chroot, it still plays crucial role in FreeBSD jail implementation.

rooam-dev 7y ago

Still learning, but the diff would be similar between VMs and Containers on Linux.

StreamBright 7y ago

Apples and oranges. Jails to not support any other operating system than the host.

loeg 7y ago
> Jails to not support any other operating system than the host. This oversimplifies. The kernel is the same in the jail and the host. But FreeBSD has a Linux syscall emulation layer, and you can definitely install a Linux userspace in a jail and run essentially Linux-but-the-kernel in the jail.