3 ms·
Hmm ... I was about to respond and say the opposite :) My (personal) unbound jail has 95 files in it. The reason it has so many files is because it is simulta
by rsync 6y ago
Hmm ... I was about to respond and say the opposite :)
My (personal) unbound jail has 95 files in it. The reason it has so many files is because it is simultaneously my 'nsd' jail.
Which is to say, I actually point two different 'jail' commands at the same directory - each with a different IP and command line:
/usr/sbin/jail /jails/dns ns1 1.2.3.4 /nsd/nsd -c /nsd/nsd.conf
/usr/sbin/jail /jails/dns dns 1.2.3.5 /unbound/unbound -c /unbound/unbound.conf
So /jails/dns is a holder for two different dns servers and they run, jailed, from the same root. It's a little unorthodox but in this case I find it to be elegant.
- toast0 6y agoI agree. I would run jails with very few files. A static executable, a config file, a log file, and some pipes maybe. Don't need anything else, don't want anything else (log file could be avoided with syslog, perhaps)
- rsync 6y agoBonus points: chflag schg the exe and config files such that they cannot be altered ... or better yet, make it a zfs filesystem and mount it read-only ...
- UI_at_80x24 6y agoI completely agree that the capability of running jails like that is awesome, and truth be told my original intention. For some of my jails that is how I run them too. Especially where I am being especially paranoid about security. I was trying to answer about 'general use/unexpected gotchas' scenario. We deal with the hands we are given. I wish I could run it as tight as that on all of my boxes, but the bosses I deal with do not want to waste money on upgrading old infrastructure but still get mad when it isn't running. So fat jails are my best compromise. My other option was a virtualbox/vmware setup.