5 ms·

I love FreeBSD and i love Jails, but you're right. Docker won because of simplicity. Dockerfiles make it super simple. There is similar stuff for jails but you

I love FreeBSD and i love Jails, but you're right. Docker won because of simplicity. Dockerfiles make it super simple. There is similar stuff for jails but you need a jails frontend that use it. A few years ago i wanted to build the Jailfile equivalent, call it Warden, and have Warden manage the jails. But honestly i doubt it would get traction outside a small community.

Sunspark 4y ago
Build it and they will come..
throwaway7980 4y ago
CBSDfiles, reggae and bastillebsd can all build jails from a file based method
SoftTalker 4y ago
"Simple" is subjective. Have you ever looked at what Docker puts in your iptables? I challenge you to understand what's happening with your networking after that. If you want containers, lxc command line and a bit of configuration for a bridge interface is all you really need.
- ajross 4y ago
  > If you want containers, [...] is all you really need. And that is the attitude embraced by jails (to be clear: rather more cleanly and attractively than the expression of the same ideas in linux), and precisely why it lost. No one wants "containers". They want docker. They want to be handed something that looks no more threatening than a mid-80's build script and have it magically be it's own little world with all its own software and versions and stuff, but still talk to the rest of the world on the same networks from the same piece of hardware (yes, via some weird voodoo to glue all that together). It's like arguing that no one needs word processing because nroff or LaTeX is all you need. It's not wrong. It's just a failure in the market.
  - SoftTalker 4y ago
    The voodoo is what bothers me. As the person responsible for the server, when things go wrong I will get blamed. In that situation, I at least want it to be my fault.
    - Gordonjcp 4y ago
      What "voodoo"?
      - isbvhodnvemrwvn 4y ago
        Stock docker puts entries in your iptables which usually fully bypasses your firewall. try installing docker on stock Ubuntu, run a container with an exposed port, put ifw up blocking all traffic, and the container is still going to be reachable.
        Gordonjcp 4y ago
        That's not voodoo, that's perfectly reasonable behaviour. Why are you wasting time with ipfw?
- Gordonjcp 4y ago
  > Have you ever looked at what Docker puts in your iptables? Some forwarding rules. > I challenge you to understand what's happening with your networking after that. They're incredibly simple forwarding rules, to make sure that only the containers that you specify can connect to the Internet, and all the others in a particular group can only connect to each other. > If you want containers, lxc command line and a bit of configuration for a bridge interface is all you really need. Yes, assuming you never need to maintain it, or run more than one project per server.
GekkePrutser 4y ago
> Dockerfiles make it super simple. There is similar stuff for jails but you need a jails frontend that use it. But docker is just a frontend for linux containers :) You're not comparing the right things here: Linux containers with a popular frontend and all the trimmings, to barebones FreeBSD jails.
- intothemild 4y ago
  Very true. I did mention that there are similar things with jail frontends, specifically iocage.

Sunspark 4y ago

Build it and they will come..

throwaway7980 4y ago

CBSDfiles, reggae and bastillebsd can all build jails from a file based method

SoftTalker 4y ago

"Simple" is subjective. Have you ever looked at what Docker puts in your iptables? I challenge you to understand what's happening with your networking after that. If you want containers, lxc command line and a bit of configuration for a bridge interface is all you really need.

ajross 4y ago
> If you want containers, [...] is all you really need. And that is the attitude embraced by jails (to be clear: rather more cleanly and attractively than the expression of the same ideas in linux), and precisely why it lost. No one wants "containers". They want docker. They want to be handed something that looks no more threatening than a mid-80's build script and have it magically be it's own little world with all its own software and versions and stuff, but still talk to the rest of the world on the same networks from the same piece of hardware (yes, via some weird voodoo to glue all that together). It's like arguing that no one needs word processing because nroff or LaTeX is all you need. It's not wrong. It's just a failure in the market.
- SoftTalker 4y ago
  The voodoo is what bothers me. As the person responsible for the server, when things go wrong I will get blamed. In that situation, I at least want it to be my fault.
  - Gordonjcp 4y ago
    What "voodoo"?
    - isbvhodnvemrwvn 4y ago
      Stock docker puts entries in your iptables which usually fully bypasses your firewall. try installing docker on stock Ubuntu, run a container with an exposed port, put ifw up blocking all traffic, and the container is still going to be reachable.
      - Gordonjcp 4y ago
        That's not voodoo, that's perfectly reasonable behaviour. Why are you wasting time with ipfw?
Gordonjcp 4y ago
> Have you ever looked at what Docker puts in your iptables? Some forwarding rules. > I challenge you to understand what's happening with your networking after that. They're incredibly simple forwarding rules, to make sure that only the containers that you specify can connect to the Internet, and all the others in a particular group can only connect to each other. > If you want containers, lxc command line and a bit of configuration for a bridge interface is all you really need. Yes, assuming you never need to maintain it, or run more than one project per server.

GekkePrutser 4y ago

> Dockerfiles make it super simple. There is similar stuff for jails but you need a jails frontend that use it. But docker is just a frontend for linux containers :) You're not comparing the right things here: Linux containers with a popular frontend and all the trimmings, to barebones FreeBSD jails.

intothemild 4y ago
Very true. I did mention that there are similar things with jail frontends, specifically iocage.